Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
Secrets Management
Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.
Purpose
Implement secure secrets management in CI/CD pipelines without hardcoding sensitive information.
When to Use
Store API keys and credentials
Manage database passwords
Handle TLS certificates
Rotate secrets automatically
Implement least-privilege access
Secrets Management Tools
HashiCorp Vault
Centralized secrets management
Dynamic secrets generation
Secret rotation
Audit logging
Fine-grained access control
AWS Secrets Manager
AWS-native solution
Automatic rotation
Integration with RDS
CloudFormation support
Azure Key Vault
Azure-native solution
HSM-backed keys
Certificate management
RBAC integration
Google Secret Manager
GCP-native solution
Versioning
IAM integration
HashiCorp Vault Integration
Setup Vault
# Start Vault dev server
vault server -dev
# Set environmentexport VAULT_ADDR='http://127.0.0.1:8200'export VAULT_TOKEN='root'
vault secrets -path=secret kv-v2
vault kv put secret/database/config username=admin password=secret
# Enable secrets engine
enable
# Store secret
GitHub Actions with Vault
name:DeploywithVaultSecretson: [push]
jobs:deploy:runs-on:ubuntu-lateststeps:-uses:actions/checkout@v4-name:ImportSecretsfromVaultuses:hashicorp/vault-action@v2with:url:https://vault.example.com:8200token:${{secrets.VAULT_TOKEN}}secrets:|
secret/data/database username | DB_USERNAME ;
secret/data/database password | DB_PASSWORD ;
secret/data/api key | API_KEY
-name:Usesecretsrun:|
echo "Connecting to database as $DB_USERNAME"
# Use $DB_PASSWORD, $API_KEY
GitLab CI with Vault
deploy:image:vault:latestbefore_script:-exportVAULT_ADDR=https://vault.example.com:8200-exportVAULT_TOKEN=$VAULT_TOKEN-apkaddcurljqscript:-|
DB_PASSWORD=$(vault kv get -field=password secret/database/config)
API_KEY=$(vault kv get -field=key secret/api/credentials)
echo "Deploying with secrets..."
# Use $DB_PASSWORD, $API_KEY
