secrets-management

1# Secrets Management
2 
3Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.
4 
5## Purpose
6 
7Implement secure secrets management in CI/CD pipelines without hardcoding sensitive information.
8 
9## When to Use
10 
11- Store API keys and credentials
12- Manage database passwords
13- Handle TLS certificates
14- Rotate secrets automatically
15- Implement least-privilege access
16 
17## Secrets Management Tools
18 
19### HashiCorp Vault
20 
21- Centralized secrets management
22- Dynamic secrets generation
23- Secret rotation
24- Audit logging
25- Fine-grained access control
26 
27### AWS Secrets Manager
28 
29- AWS-native solution
30- Automatic rotation
31- Integration with RDS
32- CloudFormation support
33 
34### Azure Key Vault
35 
36- Azure-native solution
37- HSM-backed keys
38- Certificate management
39- RBAC integration
40 
41### Google Secret Manager
42 
43- GCP-native solution
44- Versioning
45- IAM integration
46 
47## HashiCorp Vault Integration
48 
49### Setup Vault
50 
51```bash
52# Start Vault dev server
53vault server -dev
54 
55# Set environment
56export VAULT_ADDR='http://127.0.0.1:8200'
57export VAULT_TOKEN='root'
58 
59# Enable secrets engine
60vault secrets enable -path=secret kv-v2
61 
62# Store secret
63vault kv put secret/database/config username=admin password=secret
64```
65 
66### GitHub Actions with Vault
67 
68```yaml
69name: Deploy with Vault Secrets
70 
71on: [push]
72 
73jobs:
74  deploy:
75    runs-on: ubuntu-latest
76    steps:
77      - uses: actions/checkout@v4
78 
79      - name: Import Secrets from Vault
80        uses: hashicorp/vault-action@v2
81        with:
82…