What secrets management backends does this skill integrate with?

This skill integrates with HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and Google Secret Manager, as well as CI/CD platforms like GitHub Actions, GitLab CI, Terraform, and Kubernetes via External Secrets Operator.

When should I NOT use this skill?

Do not use this skill if you plan to hardcode secrets in source control, cannot secure access to the secrets backend, or only need local development values without sharing.

Does this skill support automatic secret rotation?

Yes, the skill provides rotation automation capabilities, with AWS Secrets Manager and HashiCorp Vault offering automatic rotation features, and includes audit logging to track all secret access and changes.

How do I retrieve secrets in a GitHub Actions workflow?

You can use the hashicorp/vault-action@v2 action to import secrets from Vault by specifying the Vault URL, token, and secret paths, which are then made available as environment variables in your workflow steps.

Skill

Securely Manage Secrets in CI/CD

Name: Secrets Management
Availability: OnlineOnly
Author: Antigravity

Secure secrets management for CI/CD pipelines across Vault, AWS/Azure/GCP secret managers, with rotation and scanning.

Get skill

Works with vaultaws secrets managerazure key vaultgoogle secret managergithub actions

Antigravity

Own this? Claim it

Spark score

out of 100

Updated last month

Version 13.1.0

Add to Favorites

Why it matters

Implement robust secrets management practices for your CI/CD pipelines, ensuring sensitive information like API keys, database credentials, and TLS certificates are never hardcoded and are securely stored and accessed.

Outcomes

What it gets done

Integrate with HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or Google Secret Manager.

Automate secret retrieval and rotation within CI/CD workflows.

Implement least-privilege access and audit logging for secrets.

Perform secret scanning to detect and prevent leaks.

Install

Add it to your toolbox

Run in your project directory:

curl -fsSL https://spark.entire.vc/get/ag-secrets-management | bash

Overview

Secrets Management

Secure secrets management for CI/CD pipelines across HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and Google Secret Manager, with concrete setup for GitHub Actions, GitLab CI, Terraform, Kubernetes sync, and rotation. Use it when storing credentials, managing database passwords or TLS certificates, automating secret rotation, or implementing least-privilege access in a CI/CD pipeline.

What it does

Implements secure secrets management for CI/CD pipelines without hardcoding sensitive values, across HashiCorp Vault (centralized secrets, dynamic secret generation, rotation, audit logging, fine-grained access), AWS Secrets Manager (native RDS integration, CloudFormation support), Azure Key Vault (HSM-backed keys, RBAC), and Google Secret Manager (versioning, IAM integration). Provides concrete setup for each: starting a Vault dev server and storing a KV secret, pulling Vault secrets into GitHub Actions via hashicorp/vault-action or GitLab CI via the vault CLI image, creating and retrieving an AWS secret via the CLI and GitHub Actions with automatic log masking, referencing a Secrets Manager value from Terraform, and consuming GitHub/GitLab native secrets and protected/masked CI variables.

### Store secret
vault kv put secret/database/config username=admin password=secret

It covers automated secret rotation (a Lambda handler that fetches, regenerates, updates, and re-stores a secret) versus a five-step manual rotation process, Kubernetes secret sync via the External Secrets Operator (SecretStore/ExternalSecret CRDs pointed at Vault with a refresh interval), and secret-leak scanning with TruffleHog as both a pre-commit hook and a CI pipeline stage. Its ten best practices: never commit secrets, use different secrets per environment, rotate regularly, enforce least privilege, enable audit logging, scan for leaked secrets, mask secrets in logs, encrypt at rest, prefer short-lived tokens, and document secret requirements.

When to use - and when NOT to

Use it when storing API keys and credentials, managing database passwords, handling TLS certificates, automating secret rotation, or implementing least-privilege access in a CI/CD pipeline. Not a fit for hardcoding secrets into source control, when the secrets backend itself can't be secured, or when only local, unshared development values are needed.

Inputs and outputs

Input: a CI/CD pipeline or Kubernetes deployment needing secret storage, injection, or rotation. Output: backend-specific setup commands, pipeline YAML for GitHub Actions or GitLab CI secret injection, Terraform data-source wiring, rotation Lambda code or a manual rotation runbook, and secret-scanning hooks or CI stages.

Integrations

Integrates HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, and Google Secret Manager as secrets backends; GitHub Actions and GitLab CI as pipeline targets; Terraform for infrastructure-level secret references; the External Secrets Operator for Kubernetes; and TruffleHog/GitGuardian for secret-leak scanning. Delegates to sibling skills github-actions-templates, gitlab-ci-patterns, and deployment-pipeline-design for the surrounding pipeline architecture.

Who it's for

Platform and DevOps engineers wiring secret storage, injection, and rotation into a CI/CD pipeline who need concrete, backend-specific commands rather than abstract secrets-management advice.

FAQ

Common questions

Discussion