Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

Secrets Management Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools. Purpose Implement secure secrets management in CI/CD pipelines without hardcoding sensitive information. When to Use Store API keys and credentials Manage database passwords Handle TLS certificates Rotate secrets automatically Implement least privilege access Secrets Management Tools HashiCorp Vault Centralized secrets management Dynamic secrets generation Secret rotation Audit logging Fine grained access control AWS Secrets Manager AWS native solution Automatic rotation Integration with RDS CloudFormation support Azure Key Vault Azure native solution HSM backed keys Certificate management RBAC integration Google Secret Manager GCP native solution Versioning IAM integration HashiCorp Vault Integration Setup Vault GitHub Actions with Vault GitLab CI with Vault Reference: See references/vault setup.md AWS Secrets Manager Store Secret Retrieve in GitHub Actions Terraform with AWS Secrets Manager GitHub Secrets Organization/Repository Secrets Environment Secrets Reference: See references/github secrets.md GitLab CI/CD Variables Project Variables Protected and Masked Variables Protected: Only available in protected branches Masked: Hidden in job logs File type: Stored as file Best Practices 1. Never commit secrets to Git 2. Use different secrets per environment 3. Rotate secrets regularly 4. Implement least privilege access 5. Enable audit logging 6. Use secret scanning (GitGuardian, TruffleHog) 7. Mask secrets in logs 8. Encrypt secrets at rest 9. Use short lived tokens when possible 10. Document secret requirements Secret Rotation Automated Rotation with AWS Manual Rotation Process 1. Generate new secret 2. Update secret in secret store 3. Update applications to use new secret 4. Verify functionality 5. Revoke old secret External Secrets Operator Kubernetes Integration Secret Scanning Pre commit Hook CI/CD Secret Scanning Related Skills github actions templates For GitHub Actions integration gitlab ci patterns For GitLab CI integration deployment pipeline design For pipeline architecture

secrets-management