Secrets Management

作者 wshobson46891e7e60da無授權條款收錄於 2026年10月8日更新於 2026年10月8日

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

僅含說明SecurityDevOps & Cloud
AI 產生的概覽

提供在 CI/CD 流程中使用 Vault、AWS Secrets Manager 與平台原生方案管理密鑰的指引。

功能
此技能提供在 CI/CD 流程中存放、取得、輪換與掃描密鑰的說明與設定範例。內容涵蓋 HashiCorp Vault、AWS Secrets Manager、Azure Key Vault、Google Secret Manager、GitHub Secrets、GitLab CI/CD 變數、Kubernetes 的 External Secrets Operator，以及密鑰掃描工具。產出為參考片段與最佳實務建議，而非可執行的工具。
適用情境
適用於在流程中處理敏感憑證的情境，例如存放 API 金鑰與資料庫密碼、管理 TLS 憑證、輪換密鑰或落實最小權限存取。也適合用來強化 CI/CD 環境，以及在提交或流程中加入密鑰掃描。
執行需求
不隨附指令碼，僅為說明文件。依範例操作需要能存取 Vault、AWS Secrets Manager、Azure Key Vault 或 Google Secret Manager 等密鑰存放區，以及 GitHub Actions 或 GitLab CI 等 CI/CD 平台，可能還需要 Kubernetes、Terraform、Docker 與密鑰掃描工具。

Secrets Management

Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.

Purpose

Implement secure secrets management in CI/CD pipelines without hardcoding sensitive information.

When to Use

  • Store API keys and credentials
  • Manage database passwords
  • Handle TLS certificates
  • Rotate secrets automatically
  • Implement least-privilege access

Secrets Management Tools

HashiCorp Vault

  • Centralized secrets management
  • Dynamic secrets generation
  • Secret rotation
  • Audit logging
  • Fine-grained access control

AWS Secrets Manager

  • AWS-native solution
  • Automatic rotation
  • Integration with RDS
  • CloudFormation support

Azure Key Vault

  • Azure-native solution
  • HSM-backed keys
  • Certificate management
  • RBAC integration

Google Secret Manager

  • GCP-native solution
  • Versioning
  • IAM integration

HashiCorp Vault Integration

Setup Vault

bash
# Start Vault dev servervault server -dev
# Set environmentexport VAULT_ADDR='http://127.0.0.1:8200'export VAULT_TOKEN='root'
# Enable secrets enginevault secrets enable -path=secret kv-v2
# Store secretvault kv put secret/database/config username=admin password=secret

GitHub Actions with Vault

yaml
name: Deploy with Vault Secrets
on: [push]
jobs:  deploy:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4
      - name: Import Secrets from Vault        uses: hashicorp/vault-action@v2        with:          url: https://vault.example.com:8200          token: ${{ secrets.VAULT_TOKEN }}          secrets: |            secret/data/database username | DB_USERNAME ;            secret/data/database password | DB_PASSWORD ;            secret/data/api key | API_KEY
      - name: Use secrets        run: |          echo "Connecting to database as $DB_USERNAME"          # Use $DB_PASSWORD, $API_KEY

GitLab CI with Vault

yaml
deploy:  image: vault:1.17  before_script:    - export VAULT_ADDR=https://vault.example.com:8200    - export VAULT_TOKEN=$VAULT_TOKEN    - apk add curl jq  script:    - |      DB_PASSWORD=$(vault kv get -field=password secret/database/config)      API_KEY=$(vault kv get -field=key secret/api/credentials)      echo "Deploying with secrets..."      # Use $DB_PASSWORD, $API_KEY

AWS Secrets Manager

Store Secret

bash
aws secretsmanager create-secret \  --name production/database/password \  --secret-string "super-secret-password"

Retrieve in GitHub Actions

yaml
- name: Configure AWS credentials  uses: aws-actions/configure-aws-credentials@v4  with:    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}    aws-region: us-west-2
- name: Get secret from AWS  run: |    SECRET=$(aws secretsmanager get-secret-value \      --secret-id production/database/password \      --query SecretString \      --output text)    echo "::add-mask::$SECRET"    echo "DB_PASSWORD=$SECRET" >> $GITHUB_ENV
- name: Use secret  run: |    # Use $DB_PASSWORD    ./deploy.sh

Terraform with AWS Secrets Manager

hcl
data "aws_secretsmanager_secret_version" "db_password" {  secret_id = "production/database/password"}
resource "aws_db_instance" "main" {  allocated_storage    = 100  engine              = "postgres"  instance_class      = "db.t3.large"  username            = "admin"  password            = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)["password"]}

GitHub Secrets

Organization/Repository Secrets

yaml
- name: Use GitHub secret  env:    API_KEY: ${{ secrets.API_KEY }}    DATABASE_URL: ${{ secrets.DATABASE_URL }}  run: |    # Secrets are injected as env vars — never print them to logs    ./deploy.sh

Environment Secrets

yaml
deploy:  runs-on: ubuntu-latest  environment: production  steps:    - name: Deploy      env:        PROD_API_KEY: ${{ secrets.PROD_API_KEY }}      run: |        # Secret injected as env var — never print to logs        ./deploy.sh

GitLab CI/CD Variables

Project Variables

yaml
deploy:  script:    - echo "Deploying with $API_KEY"    - echo "Database: $DATABASE_URL"

Protected and Masked Variables

  • Protected: Only available in protected branches
  • Masked: Hidden in job logs
  • File type: Stored as file

Best Practices

  1. Never commit secrets to Git
  2. Use different secrets per environment
  3. Rotate secrets regularly
  4. Implement least-privilege access
  5. Enable audit logging
  6. Use secret scanning (GitGuardian, TruffleHog)
  7. Mask secrets in logs
  8. Encrypt secrets at rest
  9. Use short-lived tokens when possible
  10. Document secret requirements

Secret Rotation

Automated Rotation with AWS

python
import boto3import json
def lambda_handler(event, context):    client = boto3.client('secretsmanager')
    # Get current secret    response = client.get_secret_value(SecretId='my-secret')    current_secret = json.loads(response['SecretString'])
    # Generate new password    new_password = generate_strong_password()
    # Update database password    update_database_password(new_password)
    # Update secret    client.put_secret_value(        SecretId='my-secret',        SecretString=json.dumps({            'username': current_secret['username'],            'password': new_password        })    )
    return {'statusCode': 200}

Manual Rotation Process

  1. Generate new secret
  2. Update secret in secret store
  3. Update applications to use new secret
  4. Verify functionality
  5. Revoke old secret

External Secrets Operator

Kubernetes Integration

yaml
apiVersion: external-secrets.io/v1beta1kind: SecretStoremetadata:  name: vault-backend  namespace: productionspec:  provider:    vault:      server: "https://vault.example.com:8200"      path: "secret"      version: "v2"      auth:        kubernetes:          mountPath: "kubernetes"          role: "production"
---apiVersion: external-secrets.io/v1beta1kind: ExternalSecretmetadata:  name: database-credentials  namespace: productionspec:  refreshInterval: 1h  secretStoreRef:    name: vault-backend    kind: SecretStore  target:    name: database-credentials    creationPolicy: Owner  data:    - secretKey: username      remoteRef:        key: database/config        property: username    - secretKey: password      remoteRef:        key: database/config        property: password

Secret Scanning

Pre-commit Hook

bash
#!/bin/bash# .git/hooks/pre-commit
# Check for secrets with TruffleHogdocker run --rm -v "$(pwd):/repo" \  trufflesecurity/trufflehog:3.88 \  filesystem --directory=/repo
if [ $? -ne 0 ]; then  echo "❌ Secret detected! Commit blocked."  exit 1fi

CI/CD Secret Scanning

yaml
secret-scan:  stage: security  image: trufflesecurity/trufflehog:3.88  script:    - trufflehog filesystem .  allow_failure: false

Related Skills

  • github-actions-templates - For GitHub Actions integration
  • gitlab-ci-patterns - For GitLab CI integration
  • deployment-pipeline-design - For pipeline architecture

來源與署名

來源：wshobson/agents位於plugins/cicd-automation/skills/secrets-management提交46891e7

授權條款： 無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

更多來自 wshobson/agents 的技能

Uv Package Manager

wshobson

關於使用 uv Python 套件管理器管理相依性、虛擬環境與專案工作流程的參考指南。

Software Development2026年10月8日

Web Component Design

wshobson

指導在 React、Vue 和 Svelte 中建構可重複使用的 UI 元件，涵蓋組合模式、CSS-in-JS 選擇與元件 API 設計。

Software Development2026年10月8日

Python Type Safety

wshobson

指導 Python 型別註解、泛型、協定以及 mypy/pyright 嚴格型別檢查。

Software Development2026年10月8日

Visual Design Foundations

wshobson

指導排版、色彩、間距與圖示設計，協助建立一致且無障礙的視覺設計系統。

Design & Creative2026年10月8日

Responsive Design

wshobson

指導使用容器查詢、流體排版、CSS Grid 與斷點策略實作響應式網頁版面。

Software Development2026年10月8日

Python Resource Management

wshobson

指導 Python 開發者使用情境管理器、清理模式與串流處理來確定性地管理資源。

Software Development2026年10月8日

更多Security技能

Compliance Tracking

anthropics

精選

追蹤合規要求、稽核準備情況，以及 SOC 2、ISO 27001、GDPR、HIPAA 和 PCI DSS 等框架的證據。

Security27K今天更新

Dpop Adoption

google

精選

指導為 Google OAuth 平台實作 OAuth 2.0 DPoP（RFC 9449）傳送方約束的更新權杖。

Security21K今天更新

Secops Triage

google

精選

引導 SOC 分析師對 Google SecOps 安全警示進行分診，從調查到結案或升級。

Security21K今天更新

Secops Investigate

google

精選

指導 SOC 分析師在 Google SecOps 中使用 UDM 查詢與時間軸進行深入的安全事件與實體調查。

Security21K今天更新

Secops Hunt

google

精選

指導在 Google SecOps 中使用 UDM 查詢、IoC 回溯、普遍性與異常分析進行主動威脅狩獵。

Security21K今天更新

Secops Cases

google

精選

透過 MCP 工具管理 Google Security Operations SOAR 案件的完整生命週期。

Security21K今天更新