AgentAlley

Skills · Infrastructure & ops

Secrets Management

Unverified●32/40

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

Originally by wshobson · MIT

Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor·UnknownWe have not crawled the repo tree, so we will not guess
Codex·UnknownWe have not crawled the repo tree, so we will not guess
Gemini CLI·UnknownThe spec defines no detection rule for Gemini
Copilot·UnknownWe have not crawled the repo tree, so we will not guess
npx agentalley add secrets-management

This command does not work yet — the CLI is still being built. Until then, use Raw in the reader below to take the file.

Who is stuck, and on what

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

The whole source

No sign-in, no blur, nothing truncated
secrets-management/SKILL.md354 lines7.5 KBRawView on GitHub
Frontmatter — 2 properties
namesecrets-management
descriptionImplement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
1---
2name: secrets-management
3description: Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
4---A5 — No allowed-tools declared — no way to tell what this skill may touch
5 
6# Secrets Management
7 
8Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.
9 
10## Purpose
11 
12Implement secure secrets management in CI/CD pipelines without hardcoding sensitive information.
13 
14## When to Use
15 
16- Store API keys and credentials
17- Manage database passwords
18- Handle TLS certificates
19- Rotate secrets automatically
20- Implement least-privilege access
21 
22## Secrets Management Tools
23 
24### HashiCorp Vault
25 
26- Centralized secrets management
27- Dynamic secrets generation
28- Secret rotation
29- Audit logging
30- Fine-grained access control
31 
32### AWS Secrets Manager
33 
34- AWS-native solution
35- Automatic rotation
36- Integration with RDS
37- CloudFormation support
38 
39### Azure Key Vault
40 
41- Azure-native solution
42- HSM-backed keys
43- Certificate management
44- RBAC integration
45 
46### Google Secret Manager
47 
48- GCP-native solution
49- Versioning
50- IAM integration
51 
52## HashiCorp Vault Integration
53 
54### Setup Vault
55 
56```bash
57# Start Vault dev server
58vault server -dev
59 
60# Set environment
61export VAULT_ADDR='http://127.0.0.1:8200'
62export VAULT_TOKEN='root'
63 
64# Enable secrets engine
65vault secrets enable -path=secret kv-v2
66 
67# Store secret
68vault kv put secret/database/config username=admin password=secret
69```
70 
71### GitHub Actions with Vault
72 
73```yaml
74name: Deploy with Vault Secrets
75 
76on: [push]
77 
78jobs:
79 deploy:
80 runs-on: ubuntu-latest
81 steps:
82 - uses: actions/checkout@v4
83 
84 - name: Import Secrets from Vault
85 uses: hashicorp/vault-action@v2
86 with:
87 url: https://vault.example.com:8200
88 token: ${{ secrets.VAULT_TOKEN }}
89 secrets: |
90 secret/data/database username | DB_USERNAME ;
91 secret/data/database password | DB_PASSWORD ;
92 secret/data/api key | API_KEY
93 
94 - name: Use secrets
95 run: |
96 echo "Connecting to database as $DB_USERNAME"
97 # Use $DB_PASSWORD, $API_KEY
98```
99 
100### GitLab CI with Vault
101 
102```yaml
103deploy:
104 image: vault:1.17
105 before_script:
106 - export VAULT_ADDR=https://vault.example.com:8200
107 - export VAULT_TOKEN=$VAULT_TOKEN
108 - apk add curl jqA4 — This skill pulls in web or user content but never says to treat that content as data. A signal, not proof.
109 script:
110 - |
111 DB_PASSWORD=$(vault kv get -field=password secret/database/config)
112 API_KEY=$(vault kv get -field=key secret/api/credentials)
113 echo "Deploying with secrets..."
114 # Use $DB_PASSWORD, $API_KEY
115```
116 
117**Reference:** See `references/vault-setup.md`
118 
119## AWS Secrets Manager
120 
121### Store Secret
122 
123```bash
124aws secretsmanager create-secret \
125 --name production/database/password \
126 --secret-string "super-secret-password"
127```
128 
129### Retrieve in GitHub Actions
130 
131```yaml
132- name: Configure AWS credentials
133 uses: aws-actions/configure-aws-credentials@v4
134 with:
135 aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
136 aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
137 aws-region: us-west-2
138 
139- name: Get secret from AWS
140 run: |
141 SECRET=$(aws secretsmanager get-secret-value \
142 --secret-id production/database/password \
143 --query SecretString \
144 --output text)
145 echo "::add-mask::$SECRET"
146 echo "DB_PASSWORD=$SECRET" >> $GITHUB_ENV
147 
148- name: Use secret
149 run: |
150 # Use $DB_PASSWORD
151 ./deploy.sh
152```
153 
154### Terraform with AWS Secrets Manager
155 
156```hcl
157data "aws_secretsmanager_secret_version" "db_password" {
158 secret_id = "production/database/password"
159}
160 
161resource "aws_db_instance" "main" {
162 allocated_storage = 100
163 engine = "postgres"
164 instance_class = "db.t3.large"
165 username = "admin"
166 password = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)["password"]
167}
168```
169 
170## GitHub Secrets
171 
172### Organization/Repository Secrets
173 
174```yaml
175- name: Use GitHub secret
176 env:
177 API_KEY: ${{ secrets.API_KEY }}
178 DATABASE_URL: ${{ secrets.DATABASE_URL }}
179 run: |
180 # Secrets are injected as env vars — never print them to logs
181 ./deploy.sh
182```
183 
184### Environment Secrets
185 
186```yaml
187deploy:
188 runs-on: ubuntu-latest
189 environment: production
190 steps:
191 - name: Deploy
192 env:
193 PROD_API_KEY: ${{ secrets.PROD_API_KEY }}
194 run: |
195 # Secret injected as env var — never print to logs
196 ./deploy.sh
197```
198 
199**Reference:** See `references/github-secrets.md`
200 
201## GitLab CI/CD Variables
202 
203### Project Variables
204 
205```yaml
206deploy:
207 script:
208 - echo "Deploying with $API_KEY"
209 - echo "Database: $DATABASE_URL"
210```
211 
212### Protected and Masked Variables
213 
214- Protected: Only available in protected branches
215- Masked: Hidden in job logs
216- File type: Stored as file
217 
218## Best Practices
219 
2201. **Never commit secrets** to Git
2212. **Use different secrets** per environment
2223. **Rotate secrets regularly**
2234. **Implement least-privilege access**
2245. **Enable audit logging**
2256. **Use secret scanning** (GitGuardian, TruffleHog)
2267. **Mask secrets in logs**
2278. **Encrypt secrets at rest**
2289. **Use short-lived tokens** when possible
22910. **Document secret requirements**
230 
231## Secret Rotation
232 
233### Automated Rotation with AWS
234 
235```python
236import boto3
237import json
238 
239def lambda_handler(event, context):
240 client = boto3.client('secretsmanager')
241 
242 # Get current secret
243 response = client.get_secret_value(SecretId='my-secret')
244 current_secret = json.loads(response['SecretString'])
245 
246 # Generate new password
247 new_password = generate_strong_password()
248 
249 # Update database password
250 update_database_password(new_password)
251 
252 # Update secret
253 client.put_secret_value(
254 SecretId='my-secret',
255 SecretString=json.dumps({
256 'username': current_secret['username'],
257 'password': new_password
258 })
259 )
260 
261 return {'statusCode': 200}
262```
263 
264### Manual Rotation Process
265 
2661. Generate new secret
2672. Update secret in secret store
2683. Update applications to use new secret
2694. Verify functionality
2705. Revoke old secret
271 
272## External Secrets Operator
273 
274### Kubernetes Integration
275 
276```yaml
277apiVersion: external-secrets.io/v1beta1
278kind: SecretStore
279metadata:
280 name: vault-backend
281 namespace: production
282spec:
283 provider:
284 vault:
285 server: "https://vault.example.com:8200"
286 path: "secret"
287 version: "v2"
288 auth:
289 kubernetes:
290 mountPath: "kubernetes"
291 role: "production"
292 
293---
294apiVersion: external-secrets.io/v1beta1
295kind: ExternalSecret
296metadata:
297 name: database-credentials
298 namespace: production
299spec:
300 refreshInterval: 1h
301 secretStoreRef:
302 name: vault-backend
303 kind: SecretStore
304 target:
305 name: database-credentials
306 creationPolicy: Owner
307 data:
308 - secretKey: username
309 remoteRef:
310 key: database/config
311 property: username
312 - secretKey: password
313 remoteRef:
314 key: database/config
315 property: password
316```
317 
318## Secret Scanning
319 
320### Pre-commit Hook
321 
322```bash
323#!/bin/bash
324# .git/hooks/pre-commit
325 
326# Check for secrets with TruffleHog
327docker run --rm -v "$(pwd):/repo" \
328 trufflesecurity/trufflehog:3.88 \
329 filesystem --directory=/repo
330 
331if [ $? -ne 0 ]; then
332 echo "❌ Secret detected! Commit blocked."
333 exit 1
334fi
335```
336 
337### CI/CD Secret Scanning
338 
339```yaml
340secret-scan:
341 stage: security
342 image: trufflesecurity/trufflehog:3.88
343 script:
344 - trufflehog filesystem .
345 allow_failure: false
346```
347 
348 
349## Related Skills
350 
351- `github-actions-templates` - For GitHub Actions integration
352- `gitlab-ci-patterns` - For GitLab CI integration
353- `deployment-pipeline-design` - For pipeline architecture
354 

Reviews

Installed this one?Write the first review and take the Trailblazer badge.

Reviews only open after a real install, so this is empty — and we leave it empty rather than invent one.

Alternatives

Also in Infrastructure & ops
Paper Poster (HTML): measurement-gated poster generationDEFAULT poster pipeline — build an academic conference poster (ICML/NeurIPS/ICLR/CVPR/...) as a single HTML/CSS file with measurement-driven hard gates, real paper figures, a two-hue design-token system, and print-ready PDF via headless Chromium. Use when theInfrastructure & ops · MIT●····●36/40Brand Monitoring 📡Brand monitoring tool for tracking mentions across social media platforms. Monitor Reddit, Google News, YouTube, and DuckDuckGo for brand mentions. Includes sentiment analysis, trend tracking, crisis detection, and competitor comparison. No API key required foInfrastructure & ops · MIT◐····●34/40Spark Memory & Thermal OpsManage unified memory and thermals during long-running ML jobs on NVIDIA DGX Spark. Use when planning memory headroom for a training run on GB10, when a job OOMs on unified memory, or when monitoring temperature and power during multi-hour training.Infrastructure & ops · MIT◐····●32/40Deployment Pipeline DesignDesign multi-stage CI/CD pipelines with approval gates, security checks, and deployment orchestration. Use this skill when designing zero-downtime deployment pipelines, implementing canary rollout strategies, setting up multi-environment promotion workflows, or debugging failed deployment gates in CI/CD.Infrastructure & ops · MIT◐····●31/40