Secrets Management

by wshobson46891e7e60daNo licenseListed Oct 8, 2026Updated Oct 8, 2026

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

Instructions onlySecurityDevOps & Cloud
AI-generated overview

Guidance for managing secrets in CI/CD pipelines with Vault, AWS Secrets Manager, and native platform stores.

What it does
This skill provides instructions and configuration examples for storing, retrieving, rotating, and scanning secrets in CI/CD pipelines. It covers HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, GitHub Secrets, GitLab CI/CD variables, the External Secrets Operator for Kubernetes, and secret-scanning tools. It produces reference snippets and best-practice guidance rather than executable tooling.
When to use it
Use it when handling sensitive credentials in pipelines, such as storing API keys and database passwords, managing TLS certificates, rotating secrets, or enforcing least-privilege access. It also fits securing CI/CD environments and adding secret scanning to commits or pipelines.
Requirements
No scripts are shipped; it is instructions only. Following the examples assumes access to a secrets store such as Vault, AWS Secrets Manager, Azure Key Vault, or Google Secret Manager, plus CI/CD platforms like GitHub Actions or GitLab CI, and optionally Kubernetes, Terraform, Docker, and secret-scanning tools.

Secrets Management

Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.

Purpose

Implement secure secrets management in CI/CD pipelines without hardcoding sensitive information.

When to Use

  • Store API keys and credentials
  • Manage database passwords
  • Handle TLS certificates
  • Rotate secrets automatically
  • Implement least-privilege access

Secrets Management Tools

HashiCorp Vault

  • Centralized secrets management
  • Dynamic secrets generation
  • Secret rotation
  • Audit logging
  • Fine-grained access control

AWS Secrets Manager

  • AWS-native solution
  • Automatic rotation
  • Integration with RDS
  • CloudFormation support

Azure Key Vault

  • Azure-native solution
  • HSM-backed keys
  • Certificate management
  • RBAC integration

Google Secret Manager

  • GCP-native solution
  • Versioning
  • IAM integration

HashiCorp Vault Integration

Setup Vault

bash
# Start Vault dev servervault server -dev
# Set environmentexport VAULT_ADDR='http://127.0.0.1:8200'export VAULT_TOKEN='root'
# Enable secrets enginevault secrets enable -path=secret kv-v2
# Store secretvault kv put secret/database/config username=admin password=secret

GitHub Actions with Vault

yaml
name: Deploy with Vault Secrets
on: [push]
jobs:  deploy:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4
      - name: Import Secrets from Vault        uses: hashicorp/vault-action@v2        with:          url: https://vault.example.com:8200          token: ${{ secrets.VAULT_TOKEN }}          secrets: |            secret/data/database username | DB_USERNAME ;            secret/data/database password | DB_PASSWORD ;            secret/data/api key | API_KEY
      - name: Use secrets        run: |          echo "Connecting to database as $DB_USERNAME"          # Use $DB_PASSWORD, $API_KEY

GitLab CI with Vault

yaml
deploy:  image: vault:1.17  before_script:    - export VAULT_ADDR=https://vault.example.com:8200    - export VAULT_TOKEN=$VAULT_TOKEN    - apk add curl jq  script:    - |      DB_PASSWORD=$(vault kv get -field=password secret/database/config)      API_KEY=$(vault kv get -field=key secret/api/credentials)      echo "Deploying with secrets..."      # Use $DB_PASSWORD, $API_KEY

AWS Secrets Manager

Store Secret

bash
aws secretsmanager create-secret \  --name production/database/password \  --secret-string "super-secret-password"

Retrieve in GitHub Actions

yaml
- name: Configure AWS credentials  uses: aws-actions/configure-aws-credentials@v4  with:    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}    aws-region: us-west-2
- name: Get secret from AWS  run: |    SECRET=$(aws secretsmanager get-secret-value \      --secret-id production/database/password \      --query SecretString \      --output text)    echo "::add-mask::$SECRET"    echo "DB_PASSWORD=$SECRET" >> $GITHUB_ENV
- name: Use secret  run: |    # Use $DB_PASSWORD    ./deploy.sh

Terraform with AWS Secrets Manager

hcl
data "aws_secretsmanager_secret_version" "db_password" {  secret_id = "production/database/password"}
resource "aws_db_instance" "main" {  allocated_storage    = 100  engine              = "postgres"  instance_class      = "db.t3.large"  username            = "admin"  password            = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)["password"]}

GitHub Secrets

Organization/Repository Secrets

yaml
- name: Use GitHub secret  env:    API_KEY: ${{ secrets.API_KEY }}    DATABASE_URL: ${{ secrets.DATABASE_URL }}  run: |    # Secrets are injected as env vars — never print them to logs    ./deploy.sh

Environment Secrets

yaml
deploy:  runs-on: ubuntu-latest  environment: production  steps:    - name: Deploy      env:        PROD_API_KEY: ${{ secrets.PROD_API_KEY }}      run: |        # Secret injected as env var — never print to logs        ./deploy.sh

GitLab CI/CD Variables

Project Variables

yaml
deploy:  script:    - echo "Deploying with $API_KEY"    - echo "Database: $DATABASE_URL"

Protected and Masked Variables

  • Protected: Only available in protected branches
  • Masked: Hidden in job logs
  • File type: Stored as file

Best Practices

  1. Never commit secrets to Git
  2. Use different secrets per environment
  3. Rotate secrets regularly
  4. Implement least-privilege access
  5. Enable audit logging
  6. Use secret scanning (GitGuardian, TruffleHog)
  7. Mask secrets in logs
  8. Encrypt secrets at rest
  9. Use short-lived tokens when possible
  10. Document secret requirements

Secret Rotation

Automated Rotation with AWS

python
import boto3import json
def lambda_handler(event, context):    client = boto3.client('secretsmanager')
    # Get current secret    response = client.get_secret_value(SecretId='my-secret')    current_secret = json.loads(response['SecretString'])
    # Generate new password    new_password = generate_strong_password()
    # Update database password    update_database_password(new_password)
    # Update secret    client.put_secret_value(        SecretId='my-secret',        SecretString=json.dumps({            'username': current_secret['username'],            'password': new_password        })    )
    return {'statusCode': 200}

Manual Rotation Process

  1. Generate new secret
  2. Update secret in secret store
  3. Update applications to use new secret
  4. Verify functionality
  5. Revoke old secret

External Secrets Operator

Kubernetes Integration

yaml
apiVersion: external-secrets.io/v1beta1kind: SecretStoremetadata:  name: vault-backend  namespace: productionspec:  provider:    vault:      server: "https://vault.example.com:8200"      path: "secret"      version: "v2"      auth:        kubernetes:          mountPath: "kubernetes"          role: "production"
---apiVersion: external-secrets.io/v1beta1kind: ExternalSecretmetadata:  name: database-credentials  namespace: productionspec:  refreshInterval: 1h  secretStoreRef:    name: vault-backend    kind: SecretStore  target:    name: database-credentials    creationPolicy: Owner  data:    - secretKey: username      remoteRef:        key: database/config        property: username    - secretKey: password      remoteRef:        key: database/config        property: password

Secret Scanning

Pre-commit Hook

bash
#!/bin/bash# .git/hooks/pre-commit
# Check for secrets with TruffleHogdocker run --rm -v "$(pwd):/repo" \  trufflesecurity/trufflehog:3.88 \  filesystem --directory=/repo
if [ $? -ne 0 ]; then  echo "❌ Secret detected! Commit blocked."  exit 1fi

CI/CD Secret Scanning

yaml
secret-scan:  stage: security  image: trufflesecurity/trufflehog:3.88  script:    - trufflehog filesystem .  allow_failure: false

Related Skills

  • github-actions-templates - For GitHub Actions integration
  • gitlab-ci-patterns - For GitLab CI integration
  • deployment-pipeline-design - For pipeline architecture

Source and attribution

Source:wshobson/agentsinplugins/cicd-automation/skills/secrets-managementat commit46891e7

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from wshobson/agents

Uv Package Manager

wshobson

Reference guide for using the uv Python package manager for dependencies, virtual environments and project workflows.

Software DevelopmentOct 8, 2026

Web Component Design

wshobson

Guides building reusable UI components in React, Vue and Svelte, covering composition patterns, CSS-in-JS choices and component API design.

Software DevelopmentOct 8, 2026

Python Type Safety

wshobson

Guides Python type annotations, generics, protocols, and strict mypy/pyright checking.

Software DevelopmentOct 8, 2026

Visual Design Foundations

wshobson

Guides typography, color, spacing and iconography decisions for cohesive, accessible visual design systems.

Design & CreativeOct 8, 2026

Responsive Design

wshobson

Guides implementation of responsive web layouts using container queries, fluid typography, CSS Grid and breakpoints.

Software DevelopmentOct 8, 2026

Python Resource Management

wshobson

Guides Python developers in managing resources deterministically with context managers, cleanup patterns, and streaming.

Software DevelopmentOct 8, 2026

More in Security

Dpop Adoption

google

Featured

Guides implementation of OAuth 2.0 DPoP (RFC 9449) sender-constrained refresh tokens for Google's OAuth platform.

SecurityOct 8, 2026

Secops Triage

google

Featured

Guides SOC analysts through triaging Google SecOps security alerts, from investigation to closure or escalation.

SecurityOct 8, 2026

Secops Investigate

google

Featured

Guides SOC analysts through deep security incident and entity investigations in Google SecOps using UDM queries and timelines.

SecurityOct 8, 2026

Secops Hunt

google

Featured

Guides proactive threat hunting in Google SecOps using UDM queries, IoC lookback, prevalence and outlier analysis.

SecurityOct 8, 2026

Secops Cases

google

Featured

Manages Google Security Operations SOAR cases across their lifecycle via MCP tools.

SecurityOct 8, 2026

Iam Helper For Privileged Access Management

google

Featured

Guides Google Cloud Privileged Access Manager entitlement CRUD, temporary access requests, and grant approval workflows.

Includes scripts
SecurityOct 8, 2026