Secrets Management

作者 wshobson46891e7e60da无许可证收录于 2026年10月8日更新于 2026年10月8日

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

仅含说明SecurityDevOps & Cloud
AI 生成的概览

提供在 CI/CD 流水线中使用 Vault、AWS Secrets Manager 及平台原生方案管理密钥的指导。

功能
该技能提供在 CI/CD 流水线中存储、获取、轮换和扫描密钥的说明与配置示例。内容涵盖 HashiCorp Vault、AWS Secrets Manager、Azure Key Vault、Google Secret Manager、GitHub Secrets、GitLab CI/CD 变量、Kubernetes 的 External Secrets Operator 以及密钥扫描工具。产出为参考片段与最佳实践建议，而非可执行工具。
适用场景
适用于在流水线中处理敏感凭据的场景，例如存储 API 密钥和数据库密码、管理 TLS 证书、轮换密钥或实施最小权限访问。也适用于加固 CI/CD 环境以及在提交或流水线中加入密钥扫描。
运行要求
不附带脚本，仅为说明文档。按示例操作需要可访问 Vault、AWS Secrets Manager、Azure Key Vault 或 Google Secret Manager 等密钥存储，以及 GitHub Actions 或 GitLab CI 等 CI/CD 平台，可能还需要 Kubernetes、Terraform、Docker 和密钥扫描工具。

Secrets Management

Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.

Purpose

Implement secure secrets management in CI/CD pipelines without hardcoding sensitive information.

When to Use

  • Store API keys and credentials
  • Manage database passwords
  • Handle TLS certificates
  • Rotate secrets automatically
  • Implement least-privilege access

Secrets Management Tools

HashiCorp Vault

  • Centralized secrets management
  • Dynamic secrets generation
  • Secret rotation
  • Audit logging
  • Fine-grained access control

AWS Secrets Manager

  • AWS-native solution
  • Automatic rotation
  • Integration with RDS
  • CloudFormation support

Azure Key Vault

  • Azure-native solution
  • HSM-backed keys
  • Certificate management
  • RBAC integration

Google Secret Manager

  • GCP-native solution
  • Versioning
  • IAM integration

HashiCorp Vault Integration

Setup Vault

bash
# Start Vault dev servervault server -dev
# Set environmentexport VAULT_ADDR='http://127.0.0.1:8200'export VAULT_TOKEN='root'
# Enable secrets enginevault secrets enable -path=secret kv-v2
# Store secretvault kv put secret/database/config username=admin password=secret

GitHub Actions with Vault

yaml
name: Deploy with Vault Secrets
on: [push]
jobs:  deploy:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4
      - name: Import Secrets from Vault        uses: hashicorp/vault-action@v2        with:          url: https://vault.example.com:8200          token: ${{ secrets.VAULT_TOKEN }}          secrets: |            secret/data/database username | DB_USERNAME ;            secret/data/database password | DB_PASSWORD ;            secret/data/api key | API_KEY
      - name: Use secrets        run: |          echo "Connecting to database as $DB_USERNAME"          # Use $DB_PASSWORD, $API_KEY

GitLab CI with Vault

yaml
deploy:  image: vault:1.17  before_script:    - export VAULT_ADDR=https://vault.example.com:8200    - export VAULT_TOKEN=$VAULT_TOKEN    - apk add curl jq  script:    - |      DB_PASSWORD=$(vault kv get -field=password secret/database/config)      API_KEY=$(vault kv get -field=key secret/api/credentials)      echo "Deploying with secrets..."      # Use $DB_PASSWORD, $API_KEY

AWS Secrets Manager

Store Secret

bash
aws secretsmanager create-secret \  --name production/database/password \  --secret-string "super-secret-password"

Retrieve in GitHub Actions

yaml
- name: Configure AWS credentials  uses: aws-actions/configure-aws-credentials@v4  with:    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}    aws-region: us-west-2
- name: Get secret from AWS  run: |    SECRET=$(aws secretsmanager get-secret-value \      --secret-id production/database/password \      --query SecretString \      --output text)    echo "::add-mask::$SECRET"    echo "DB_PASSWORD=$SECRET" >> $GITHUB_ENV
- name: Use secret  run: |    # Use $DB_PASSWORD    ./deploy.sh

Terraform with AWS Secrets Manager

hcl
data "aws_secretsmanager_secret_version" "db_password" {  secret_id = "production/database/password"}
resource "aws_db_instance" "main" {  allocated_storage    = 100  engine              = "postgres"  instance_class      = "db.t3.large"  username            = "admin"  password            = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)["password"]}

GitHub Secrets

Organization/Repository Secrets

yaml
- name: Use GitHub secret  env:    API_KEY: ${{ secrets.API_KEY }}    DATABASE_URL: ${{ secrets.DATABASE_URL }}  run: |    # Secrets are injected as env vars — never print them to logs    ./deploy.sh

Environment Secrets

yaml
deploy:  runs-on: ubuntu-latest  environment: production  steps:    - name: Deploy      env:        PROD_API_KEY: ${{ secrets.PROD_API_KEY }}      run: |        # Secret injected as env var — never print to logs        ./deploy.sh

GitLab CI/CD Variables

Project Variables

yaml
deploy:  script:    - echo "Deploying with $API_KEY"    - echo "Database: $DATABASE_URL"

Protected and Masked Variables

  • Protected: Only available in protected branches
  • Masked: Hidden in job logs
  • File type: Stored as file

Best Practices

  1. Never commit secrets to Git
  2. Use different secrets per environment
  3. Rotate secrets regularly
  4. Implement least-privilege access
  5. Enable audit logging
  6. Use secret scanning (GitGuardian, TruffleHog)
  7. Mask secrets in logs
  8. Encrypt secrets at rest
  9. Use short-lived tokens when possible
  10. Document secret requirements

Secret Rotation

Automated Rotation with AWS

python
import boto3import json
def lambda_handler(event, context):    client = boto3.client('secretsmanager')
    # Get current secret    response = client.get_secret_value(SecretId='my-secret')    current_secret = json.loads(response['SecretString'])
    # Generate new password    new_password = generate_strong_password()
    # Update database password    update_database_password(new_password)
    # Update secret    client.put_secret_value(        SecretId='my-secret',        SecretString=json.dumps({            'username': current_secret['username'],            'password': new_password        })    )
    return {'statusCode': 200}

Manual Rotation Process

  1. Generate new secret
  2. Update secret in secret store
  3. Update applications to use new secret
  4. Verify functionality
  5. Revoke old secret

External Secrets Operator

Kubernetes Integration

yaml
apiVersion: external-secrets.io/v1beta1kind: SecretStoremetadata:  name: vault-backend  namespace: productionspec:  provider:    vault:      server: "https://vault.example.com:8200"      path: "secret"      version: "v2"      auth:        kubernetes:          mountPath: "kubernetes"          role: "production"
---apiVersion: external-secrets.io/v1beta1kind: ExternalSecretmetadata:  name: database-credentials  namespace: productionspec:  refreshInterval: 1h  secretStoreRef:    name: vault-backend    kind: SecretStore  target:    name: database-credentials    creationPolicy: Owner  data:    - secretKey: username      remoteRef:        key: database/config        property: username    - secretKey: password      remoteRef:        key: database/config        property: password

Secret Scanning

Pre-commit Hook

bash
#!/bin/bash# .git/hooks/pre-commit
# Check for secrets with TruffleHogdocker run --rm -v "$(pwd):/repo" \  trufflesecurity/trufflehog:3.88 \  filesystem --directory=/repo
if [ $? -ne 0 ]; then  echo "❌ Secret detected! Commit blocked."  exit 1fi

CI/CD Secret Scanning

yaml
secret-scan:  stage: security  image: trufflesecurity/trufflehog:3.88  script:    - trufflehog filesystem .  allow_failure: false

Related Skills

  • github-actions-templates - For GitHub Actions integration
  • gitlab-ci-patterns - For GitLab CI integration
  • deployment-pipeline-design - For pipeline architecture

来源与署名

来源：wshobson/agents位于plugins/cicd-automation/skills/secrets-management提交46891e7

许可证： 无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

更多来自 wshobson/agents 的技能

Uv Package Manager

wshobson

关于使用 uv Python 包管理器管理依赖、虚拟环境和项目工作流的参考指南。

Software Development2026年10月8日

Web Component Design

wshobson

指导在 React、Vue 和 Svelte 中构建可复用 UI 组件，涵盖组合模式、CSS-in-JS 选择与组件 API 设计。

Software Development2026年10月8日

Python Type Safety

wshobson

指导 Python 类型注解、泛型、协议以及 mypy/pyright 严格类型检查。

Software Development2026年10月8日

Visual Design Foundations

wshobson

指导排版、色彩、间距与图标设计，帮助建立统一且无障碍的视觉设计体系。

Design & Creative2026年10月8日

Responsive Design

wshobson

指导使用容器查询、流体排版、CSS Grid 和断点策略实现响应式网页布局。

Software Development2026年10月8日

Python Resource Management

wshobson

指导 Python 开发者使用上下文管理器、清理模式和流式处理来确定性管理资源。

Software Development2026年10月8日

更多Security技能

Compliance Tracking

anthropics

精选

跟踪合规要求、审计准备情况以及 SOC 2、ISO 27001、GDPR、HIPAA 和 PCI DSS 等框架的证据。

Security27K今天更新

Dpop Adoption

google

精选

指导为 Google OAuth 平台实现 OAuth 2.0 DPoP（RFC 9449）发送方约束刷新令牌。

Security21K今天更新

Secops Triage

google

精选

指导 SOC 分析师对 Google SecOps 安全告警进行分诊，从调查到关闭或升级。

Security21K今天更新

Secops Investigate

google

精选

指导 SOC 分析师在 Google SecOps 中使用 UDM 查询和时间线进行深入的安全事件与实体调查。

Security21K今天更新

Secops Hunt

google

精选

指导在 Google SecOps 中使用 UDM 查询、IoC 回溯、普遍性与异常分析进行主动威胁狩猎。

Security21K今天更新

Secops Cases

google

精选

通过 MCP 工具管理 Google Security Operations SOAR 案例的整个生命周期。

Security21K今天更新