# Secrets Vault Manager

> This skill should be used when the user asks to "generate Vault configurations", "plan secret rotation", "analyze vault audit logs", "manage secrets lifecycle", or "set up HashiCorp Vault".

- Skill: `borghei/secrets-vault-manager` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add borghei/secrets-vault-manager`
- Raw SKILL.md: https://api.skillmd.com/api/skills/borghei/secrets-vault-manager/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT + Commons Clause
- Author: borghei (https://skillmd.com/u/borghei)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/borghei/secrets-vault-manager

---


# Secrets Vault Manager

> **Category:** Engineering
> **Domain:** Secrets Management & Security

## Overview

The **Secrets Vault Manager** skill provides tools for generating HashiCorp Vault configurations, planning and scheduling secret rotation cycles, and analyzing vault audit logs for suspicious access patterns. Essential for teams managing secrets at scale.

## Clarify First

Before generating configs or plans, confirm these inputs. If any is unknown or vague, ASK — do not assume:

- [ ] **Task** — config generation / rotation planning / audit-log analysis (selects the script and the entire workflow)
- [ ] **Environment & secrets engines** — e.g. production + kv/database/transit (`--env`, `--secrets-engines`; shapes the generated HCL)
- [ ] **Secrets inventory & classification** — Critical/High/Medium/Low per secret (drives rotation frequencies and the schedule)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

## Quick Start

```bash
# Generate Vault configuration
python scripts/vault_config_generator.py --env production --secrets-engines kv,database,transit

# Plan secret rotation schedule
python scripts/rotation_planner.py --inventory secrets_inventory.json

# Analyze vault audit logs
python scripts/audit_log_analyzer.py --log-file vault_audit.log --format json
```

## Tools Overview

| Tool | Purpose | Key Flags |
|------|---------|-----------|
| `vault_config_generator.py` | Generate HashiCorp Vault configurations | `--env`, `--secrets-engines`, `--auth-methods` |
| `rotation_planner.py` | Plan and schedule secret rotation cycles | `--inventory`, `--policy`, `--format` |
| `audit_log_analyzer.py` | Analyze vault audit logs for anomalies | `--log-file`, `--time-range`, `--format` |

## Workflows

### Initial Vault Setup
1. Define environment and required secrets engines
2. Run `vault_config_generator.py` to generate HCL configs
3. Review and customize generated configurations
4. Apply via Terraform or Vault CLI

### Secret Rotation Planning
1. Create secrets inventory (JSON)
2. Run `rotation_planner.py` to generate schedule
3. Review rotation plan and adjust frequencies
4. Implement automated rotation where possible

### Audit Log Investigation
1. Export vault audit logs
2. Run `audit_log_analyzer.py` for anomaly detection
3. Review flagged events
4. Investigate suspicious access patterns

## Reference Documentation

- [Secrets Management Guide](references/secrets-management-guide.md) - Best practices, rotation policies, and compliance requirements

## Common Patterns

### Secret Classification
- **Critical**: Database credentials, API master keys, encryption keys
- **High**: Service account tokens, OAuth secrets, TLS certificates
- **Medium**: Third-party API keys, webhook secrets
- **Low**: Public API keys, non-sensitive configuration