secrets-management

Name: secrets-management
Author: wshobson

10kinstalls4.1kforks

How to install secrets-management?

wshobson/agents/secrets-management

$npx -y skills add wshobson/agents --skill secrets-management

Installs into the current project.

Summary

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

Files · 1

View on GitHub

SKILL.md

1	# Secrets Management
2
3	Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.
4
5	## Purpose
6
7	Implement secure secrets management in CI/CD pipelines without hardcoding sensitive information.
8
9	## When to Use
10
11	- Store API keys and credentials
12	- Manage database passwords
13	- Handle TLS certificates
14	- Rotate secrets automatically
15	- Implement least-privilege access
16
17	## Secrets Management Tools
18
19	### HashiCorp Vault
20
21	- Centralized secrets management
22	- Dynamic secrets generation
23	- Secret rotation
24	- Audit logging
25	- Fine-grained access control
26
27	### AWS Secrets Manager
28
29	- AWS-native solution
30	- Automatic rotation
31	- Integration with RDS
32	- CloudFormation support
33
34	### Azure Key Vault
35
36	- Azure-native solution
37	- HSM-backed keys
38	- Certificate management
39	- RBAC integration
40
41	### Google Secret Manager
42
43	- GCP-native solution
44	- Versioning
45	- IAM integration
46
47	## HashiCorp Vault Integration
48
49	### Setup Vault
50
51	```bash
52	# Start Vault dev server
53	vault server -dev
54
55	# Set environment
56	export VAULT_ADDR='http://127.0.0.1:8200'
57	export VAULT_TOKEN='root'
58
59	# Enable secrets engine
60	vault secrets enable -path=secret kv-v2
61
62	# Store secret
63	vault kv put secret/database/config username=admin password=secret
64	```
65
66	### GitHub Actions with Vault
67
68	```yaml
69	name: Deploy with Vault Secrets
70
71	on: [push]
72
73	jobs:
74	deploy:
75	runs-on: ubuntu-latest
76	steps:
77	- uses: actions/checkout@v4
78
79	- name: Import Secrets from Vault
80	uses: hashicorp/vault-action@v2
81	with:
82	url: https://vault.example.com:8200
83	token: ${{ secrets.VAULT_TOKEN }}
84	secrets: \|
85	secret/data/database username \| DB_USERNAME ;
86	secret/data/database password \| DB_PASSWORD ;
87	secret/data/api key \| API_KEY
88
89	- name: Use secrets
90	run: \|
91	echo "Connecting to database as $DB_USERNAME"
92	# Use $DB_PASSWORD, $API_KEY
93	```
94
95	### GitLab CI with Vault
96
97	```yaml
98	deploy:
99	image: vault:1.17
100	before_script:
101	- export VAULT_ADDR=https://vault.example.com:8200
102	- export VAULT_TOKEN=$VAULT_TOKEN
103	- apk add curl jq
104	script:
105	- \|
106	DB_PASSWORD=$(vault kv get -field=password secret/database/config)
107	API_KEY=$(vault kv get -field=key secret/api/credentials)
108	echo "Deploying with secrets..."
109	# Use $DB_PASSWORD, $API_KEY
110	```
111
112	Reference: See `references/vault-setup.md`
113
114	## AWS Secrets Manager
115
116	### Store Secret
117
118	```bash
119	aws secretsmanager create-secret \
120	--name production/database/password \
121	--secret-string "super-secret-password"
122	```
123
124	### Retrieve in GitHub Actions
125
126	```yaml
127	- name: Configure AWS credentials
128	uses: aws-actions/configure-aws-credentials@v4
129	with:
130	aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
131	aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
132	aws-region: us-west-2
133
134	- name: Get secret from AWS
135	run: \|
136	SECRET=$(aws secretsmanager get-secret-value \
137	--secret-id production/database/password \
138	--query SecretString \
139	--output text)
140	echo "::add-mask::$SECRET"
141	echo "DB_PASSWORD=$SECRET" >> $GITHUB_ENV
142
143	- name: Use secret
144	run: \|
145	# Use $DB_PASSWORD
146	./deploy.sh
147	```
148
149	### Terraform with AWS Secrets Manager
150
151	```hcl
152	data "aws_secretsmanager_secret_version" "db_password" {
153	secret_id = "production/database/password"
154	}
155
156	resource "aws_db_instance" "main" {
157	allocated_storage = 100
158	engine = "postgres"
159	instance_class = "db.t3.large"
160	username = "admin"
161	password = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)["password"]
162	}
163	```
164
165	## GitHub Secrets
166
167	### Organization/Repository Secrets
168
169	```yaml
170	- name: Use GitHub secret
171	env:
172	API_KEY: ${{ secrets.API_KEY }}
173	DATABASE_URL: ${{ secrets.DATABASE_URL }}
174	run: \|
175	# Secrets are injected as env vars — never print them to logs
176	./deploy.sh
177	```
178
179	### Environment Secrets
180
181	```yaml
182	deploy:
183	runs-on: ubuntu-latest
184	environment: production
185	steps:
186	- name: Deploy
187	env:
188	PROD_API_KEY: ${{ secrets.PROD_API_KEY }}
189	run: \|
190	# Secret injected as env var — never print to logs
191	./deploy.sh
192	```
193
194	Reference: See `references/github-secrets.md`
195
196	## GitLab CI/CD Variables
197
198	### Project Variables
199
200	```yaml
201	deploy:
202	script:
203	- echo "Deploying with $API_KEY"
204	- echo "Database: $DATABASE_URL"
205	```
206
207	### Protected and Masked Variables
208
209	- Protected: Only available in protected branches
210	- Masked: Hidden in job logs
211	- File type: Stored as file
212
213	## Best Practices
214
215	1. Never commit secrets to Git
216	2. Use different secrets per environment
217	3. Rotate secrets regularly
218	4. Implement least-privilege access
219	5. Enable audit logging
220	6. **Use secret scanning

People who liked this also viewed

6 picks

Type

secrets-management

10kinstalls4.1kforks

View on GitHub

How to install secrets-management?

wshobson/agents/secrets-management

$npx -y skills add wshobson/agents --skill secrets-management

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Secrets Management
2
3	Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.
4
5	## Purpose
6
7	Implement secure secrets management in CI/CD pipelines without hardcoding sensitive information.
8
9	## When to Use
10
11	- Store API keys and credentials
12	- Manage database passwords
13	- Handle TLS certificates
14	- Rotate secrets automatically
15	- Implement least-privilege access
16
17	## Secrets Management Tools
18
19	### HashiCorp Vault
20
21	- Centralized secrets management
22	- Dynamic secrets generation
23	- Secret rotation
24	- Audit logging
25	- Fine-grained access control
26
27	### AWS Secrets Manager
28
29	- AWS-native solution
30	- Automatic rotation
31	- Integration with RDS
32	- CloudFormation support
33
34	### Azure Key Vault
35
36	- Azure-native solution
37	- HSM-backed keys
38	- Certificate management
39	- RBAC integration
40
41	### Google Secret Manager
42
43	- GCP-native solution
44	- Versioning
45	- IAM integration
46
47	## HashiCorp Vault Integration
48
49	### Setup Vault
50
51	```bash
52	# Start Vault dev server
53	vault server -dev
54
55	# Set environment
56	export VAULT_ADDR='http://127.0.0.1:8200'
57	export VAULT_TOKEN='root'
58
59	# Enable secrets engine
60	vault secrets enable -path=secret kv-v2
61
62	# Store secret
63	vault kv put secret/database/config username=admin password=secret
64	```
65
66	### GitHub Actions with Vault
67
68	```yaml
69	name: Deploy with Vault Secrets
70
71	on: [push]
72
73	jobs:
74	deploy:
75	runs-on: ubuntu-latest
76	steps:
77	- uses: actions/checkout@v4
78
79	- name: Import Secrets from Vault
80	uses: hashicorp/vault-action@v2
81	with:
82	url: https://vault.example.com:8200
83	token: ${{ secrets.VAULT_TOKEN }}
84	secrets: \|
85	secret/data/database username \| DB_USERNAME ;
86	secret/data/database password \| DB_PASSWORD ;
87	secret/data/api key \| API_KEY
88
89	- name: Use secrets
90	run: \|
91	echo "Connecting to database as $DB_USERNAME"
92	# Use $DB_PASSWORD, $API_KEY
93	```
94
95	### GitLab CI with Vault
96
97	```yaml
98	deploy:
99	image: vault:1.17
100	before_script:
101	- export VAULT_ADDR=https://vault.example.com:8200
102	- export VAULT_TOKEN=$VAULT_TOKEN
103	- apk add curl jq
104	script:
105	- \|
106	DB_PASSWORD=$(vault kv get -field=password secret/database/config)
107	API_KEY=$(vault kv get -field=key secret/api/credentials)
108	echo "Deploying with secrets..."
109	# Use $DB_PASSWORD, $API_KEY
110	```
111
112	Reference: See `references/vault-setup.md`
113
114	## AWS Secrets Manager
115
116	### Store Secret
117
118	```bash
119	aws secretsmanager create-secret \
120	--name production/database/password \
121	--secret-string "super-secret-password"
122	```
123
124	### Retrieve in GitHub Actions
125
126	```yaml
127	- name: Configure AWS credentials
128	uses: aws-actions/configure-aws-credentials@v4
129	with:
130	aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
131	aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
132	aws-region: us-west-2
133
134	- name: Get secret from AWS
135	run: \|
136	SECRET=$(aws secretsmanager get-secret-value \
137	--secret-id production/database/password \
138	--query SecretString \
139	--output text)
140	echo "::add-mask::$SECRET"
141	echo "DB_PASSWORD=$SECRET" >> $GITHUB_ENV
142
143	- name: Use secret
144	run: \|
145	# Use $DB_PASSWORD
146	./deploy.sh
147	```
148
149	### Terraform with AWS Secrets Manager
150
151	```hcl
152	data "aws_secretsmanager_secret_version" "db_password" {
153	secret_id = "production/database/password"
154	}
155
156	resource "aws_db_instance" "main" {
157	allocated_storage = 100
158	engine = "postgres"
159	instance_class = "db.t3.large"
160	username = "admin"
161	password = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)["password"]
162	}
163	```
164
165	## GitHub Secrets
166
167	### Organization/Repository Secrets
168
169	```yaml
170	- name: Use GitHub secret
171	env:
172	API_KEY: ${{ secrets.API_KEY }}
173	DATABASE_URL: ${{ secrets.DATABASE_URL }}
174	run: \|
175	# Secrets are injected as env vars — never print them to logs
176	./deploy.sh
177	```
178
179	### Environment Secrets
180
181	```yaml
182	deploy:
183	runs-on: ubuntu-latest
184	environment: production
185	steps:
186	- name: Deploy
187	env:
188	PROD_API_KEY: ${{ secrets.PROD_API_KEY }}
189	run: \|
190	# Secret injected as env var — never print to logs
191	./deploy.sh
192	```
193
194	Reference: See `references/github-secrets.md`
195
196	## GitLab CI/CD Variables
197
198	### Project Variables
199
200	```yaml
201	deploy:
202	script:
203	- echo "Deploying with $API_KEY"
204	- echo "Database: $DATABASE_URL"
205	```
206
207	### Protected and Masked Variables
208
209	- Protected: Only available in protected branches
210	- Masked: Hidden in job logs
211	- File type: Stored as file
212
213	## Best Practices
214
215	1. Never commit secrets to Git
216	2. Use different secrets per environment
217	3. Rotate secrets regularly
218	4. Implement least-privilege access
219	5. Enable audit logging
220	6. **Use secret scanning

People who liked this also viewed

6 picks

Type