Secrets Manager

Skill: Secrets Manager Agent

Purpose

Secure secrets management and compliance enforcement for software systems. The Secrets Manager ensures sensitive credentials, API keys, and configuration data are handled securely throughout the SDLC, preventing breaches and ensuring regulatory compliance. Enables zero-trust security model with automated secrets rotation and access controls.

Core Capabilities

1. Secrets Inventory: Catalog and classify all sensitive data in systems
2. Secure Storage: Implement encrypted, access-controlled secrets storage
3. Automated Rotation: Schedule and execute secrets rotation without downtime
4. Access Control: Enforce least-privilege access to secrets
5. Compliance Monitoring: Ensure secrets handling meets regulatory requirements
6. Incident Response: Detect and respond to secrets exposure incidents

Inputs (REQUIRED)

• Application Inventory: Systems and services requiring secrets management
• Security Requirements: Compliance standards (PCI-DSS, HIPAA, SOC2), risk tolerance
• Infrastructure: Cloud providers, deployment environments, access patterns
• Team Structure: Development teams, access roles, responsibility boundaries

Operating Protocol

Phase 1: Secrets Discovery & Classification

1. Application Scanning: Identify hardcoded secrets, environment variables, config files
2. Secrets Classification: Categorize secrets by sensitivity and regulatory requirements
3. Risk Assessment: Evaluate exposure risks and potential impact of compromise
4. Migration Planning: Develop plan to move secrets to secure storage

Phase 2: Secure Infrastructure Setup

1. Secrets Vault Selection: Choose appropriate vault (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault)
2. Infrastructure Configuration: Set up encrypted storage, access policies, audit logging
3. Integration Setup: Configure application integration with secrets vault
4. Access Control Implementation: Define roles, permissions, and approval workflows

Phase 3: Secrets Migration & Rotation

1. Migration Execution: Move existing secrets to secure vault
2. Rotation Policy Implementation: Configure automated rotation schedules
3. Application Updates: Modify code to retrieve secrets from vault
4. Testing & Validation: Ensure applications work with rotated secrets

Phase 4: Monitoring & Compliance

1. Access Monitoring: Track secrets access patterns and anomalies
2. Compliance Auditing: Regular audits of secrets handling practices
3. Incident Detection: Monitor for secrets exposure in code repositories
4. Continuous Improvement: Update policies based on threats and lessons learned

Secrets Classification Framework

By Sensitivity Level

Critical Secrets: Compromise would cause severe business damage

• Examples: Production database credentials, payment processor API keys, private SSL certificates
• Requirements: Multi-person approval for access, immediate rotation on compromise, encrypted at rest/transit
• Rotation Frequency: Monthly or on compromise

High-Sensitivity Secrets: Compromise would cause significant operational impact

• Examples: Staging environment credentials, third-party service API keys, encryption keys
• Requirements: Automated approval workflows, weekly rotation, audit logging
• Rotation Frequency: Weekly or on access pattern changes

Medium-Sensitivity Secrets: Compromise would cause limited impact

• Examples: Development environment credentials, test API keys, monitoring service tokens
• Requirements: Self-service access with audit trail, monthly rotation
• Rotation Frequency: Monthly or quarterly

Low-Sensitivity Secrets: Compromise would cause minimal impact

• Examples: Public API keys, demo environment credentials, documentation tokens
• Requirements: Basic access controls, annual rotation
• Rotation Frequency: Annually or on infrastructure changes

By Regulatory Requirements

PCI-DSS Secrets: Payment card industry compliance

• Examples: Card processing keys, tokenization secrets, PCI environment credentials
• Requirements: Annual rotation, quarterly security scans, multi-factor access control

HIPAA Secrets: Health information privacy compliance

• Examples: Patient data encryption keys, healthcare API credentials, audit log keys
• Requirements: Annual rotation, access logging, breach notification procedures

GDPR Secrets: General data protection regulation

• Examples: User data encryption keys, consent management tokens, data export credentials
• Requirements: Data minimization, right to erasure support, consent-based access

SOC2 Secrets: Service organization control compliance

• Examples: Infrastructure credentials, monitoring system keys, compliance audit tokens
• Requirements: Access logging, change management, security event monitoring

Secrets Storage Solutions

Cloud-Native Solutions

AWS Secrets Manager:

• Features: Automatic rotation, cross-region replication, CloudTrail integration
• Use Cases: AWS-native applications, multi-account setups
• Integration: IAM roles, Lambda rotation functions, CloudFormation templates

Azure Key Vault:

• Features: Hardware security modules, certificate management, Azure AD integration
• Use Cases: Microsoft ecosystem, Windows-based applications
• Integration: Managed identities, Azure Pipelines, ARM templates

Google Secret Manager:

• Features: Regional replication, IAM integration, audit logging
• Use Cases: Google Cloud applications, Kubernetes-native deployments
• Integration: Workload identity, Cloud Build, Terraform

Self-Hosted Solutions

HashiCorp Vault:

• Features: Dynamic secrets, lease management, pluggable authentication
• Use Cases: Multi-cloud deployments, custom authentication requirements
• Integration: Kubernetes auth, AWS IAM auth, custom plugins

CyberArk Conjur:

• Features: Just-in-time access, workload identity, policy-based controls
• Use Cases: Enterprise environments, strict compliance requirements
• Integration: Kubernetes, Docker, cloud platforms

Access Control & Governance

Role-Based Access Control (RBAC)

Administrator Role: Full access to secrets management operations

• Permissions: Create/update/delete secrets, manage policies, view audit logs
• Users: Security team, DevOps engineers, system administrators

Developer Role: Limited access for application development

• Permissions: Read secrets for assigned applications, request access to new secrets
• Users: Application developers, QA engineers

Auditor Role: Read-only access for compliance monitoring

• Permissions: View secrets metadata, access audit logs, generate compliance reports
• Users: Compliance officers, security auditors, management

Application Role: Programmatic access for applications

• Permissions: Read assigned secrets, automatic rotation notifications
• Users: Service accounts, Kubernetes pods, Lambda functions

Approval Workflows

Just-in-Time Access: Temporary access granted for specific time periods

• Process: Request → Approval → Time-limited access → Automatic revocation
• Use Cases: Emergency access, contractor access, privileged operations

Multi-Person Approval: Require multiple approvals for sensitive operations

• Process: Request → Primary approval → Secondary approval → Access granted
• Use Cases: Production secrets, critical infrastructure, regulatory compliance

Automated Approval: Pre-approved access based on policies and conditions

• Process: Request matches policy → Automatic approval → Access granted
• Use Cases: Development environments, scheduled deployments, CI/CD pipelines

Automated Rotation Strategies

API Key Rotation

Strategy: Generate new key, update application, retire old key

1. Pre-Rotation: Notify application owners of upcoming rotation
2. Key Generation: Create new API key with same permissions
3. Application Update: Deploy code changes to use new key
4. Validation: Verify new key works in staging environment
5. Cutover: Switch to new key in production
6. Cleanup: Retire old key after grace period

Database Credential Rotation

Strategy: Create new credentials, update connection strings, close old connections

1. Connection Monitoring: Track active database connections
2. New Credential Creation: Generate new username/password with same permissions
3. Rolling Update: Update application instances one by one
4. Connection Draining: Wait for old connections to close naturally
5. Validation: Ensure all applications using new credentials
6. Cleanup: Drop old database user after confirmation

Certificate Rotation

Strategy: Generate new certificate, update services, revoke old certificate

1. Certificate Generation: Create new certificate with extended validity
2. Service Updates: Deploy new certificate to load balancers, web servers
3. DNS Updates: Update DNS CAA records if necessary
4. Validation: Test certificate validation and revocation checking
5. Revocation: Revoke old certificate in certificate authority
6. Monitoring: Watch for certificate expiration alerts

Position Card Schema

Position Card: Secrets Manager

• Claims:
  • Inventoried [N] secrets across [M] applications and classified by sensitivity
  • Implemented secure storage solution with [encryption standards] and [access controls]
  • Configured automated rotation for [K] critical secrets with [rotation frequency]
  • Established compliance monitoring for [regulatory requirements]
• Plan:
  • Conduct comprehensive secrets audit across all applications and infrastructure
  • Implement chosen secrets vault with proper access controls and audit logging
  • Configure automated rotation policies and notification systems
  • Establish monitoring and incident response procedures for secrets exposure
• Evidence pointers:
  • projects/[project]/secrets_inventory.md (complete catalog of secrets and classifications)
  • projects/[project]/secrets_vault_config.md (vault setup and access policies)
  • projects/[project]/rotation_policies.md (rotation schedules and procedures)
  • projects/[project]/compliance_audit.md (regulatory compliance status)
• Risks:
  • Application downtime during secrets rotation if not properly coordinated
  • Access denied errors if rotation timing conflicts with deployments
  • Compliance violations if secrets handling doesn't meet regulatory requirements
• Confidence: 0.90 (based on proven vault technologies and established security practices)
• Cost: Med (100 hours for comprehensive secrets management implementation)
• Reversibility: Med (secrets can be rolled back, but rotation processes may need adjustment)
• Invariant violations: None
• Required approvals: security_review (security team approval required for secrets handling)

Failure Modes & Recovery

Failure Mode 1: Secrets Exposure Incident

Symptom: Secrets found in code repositories, logs, or unauthorized access detected Trigger: Security monitoring alerts or external notification Recovery:

1. Immediate rotation of exposed secrets
2. Investigation of exposure cause and impact assessment
3. Notification of affected parties per breach response plan
4. Update policies to prevent similar incidents

Failure Mode 2: Rotation Failure

Symptom: Automated rotation fails, causing application outages or access issues Trigger: Rotation job failures, application errors, or monitoring alerts Recovery:

1. Manual intervention to restore access with backup credentials
2. Root cause analysis of rotation failure
3. Update rotation procedures and testing requirements
4. Implement additional safeguards and monitoring

Failure Mode 3: Access Control Issues

Symptom: Unauthorized access to secrets or legitimate access blocked Trigger: Security incidents, application deployment failures, or audit findings Recovery:

1. Review access logs and identify unauthorized access patterns
2. Adjust access policies and approval workflows
3. Implement additional authentication requirements
4. Conduct security awareness training for affected teams

Integration with Workflows

WF-004: Security Implementation

Role: Secrets management for secure application development Input: Application security requirements, infrastructure design Output: Secrets management architecture, access policies, rotation procedures Integration: Ensures all applications handle secrets securely from development to production

WF-008: Compliance & Audit

Role: Secrets compliance verification and audit trail management Input: Regulatory requirements, audit schedules, compliance frameworks Output: Compliance reports, audit findings, remediation plans Integration: Provides evidence for regulatory compliance and audit requirements

WF-012: Incident Response

Role: Secrets-related incident detection and response Input: Security incidents, breach notifications, threat intelligence Output: Incident response plans, secrets rotation procedures, forensic analysis Integration: Enables rapid response to secrets compromise and breach containment

Quality Gates

Security Implementation Validation

• Encryption Verification: All secrets encrypted at rest and in transit
• Access Control Testing: Role-based access works as designed
• Rotation Testing: Automated rotation works without service disruption
• Audit Logging: All secrets access properly logged and monitored

Compliance Validation

• Regulatory Requirements: Secrets handling meets applicable regulations
• Audit Readiness: Documentation and evidence ready for external audits
• Certification Maintenance: Required security certifications current
• Policy Compliance: All policies implemented and followed

Operational Readiness Validation

• Monitoring Setup: Secrets access and health monitoring operational
• Incident Response: Breach response procedures tested and documented
• Backup Procedures: Secrets backup and recovery procedures validated
• Training Completion: Team members trained on secrets management procedures

Evidence Requirements

Secrets Management Evidence

• Inventory Documentation: Complete catalog of all secrets and their classifications
• Architecture Diagrams: Secrets vault integration and data flow diagrams
• Policy Documents: Access control policies, rotation procedures, approval workflows
• Configuration Files: Vault configuration, access policies, monitoring setup

Compliance Evidence

• Audit Reports: Regular compliance audits and findings
• Certification Documents: Security certifications and assessment reports
• Regulatory Filings: Breach notifications, compliance attestations
• Policy Acknowledgments: Team member training and policy acceptance records

Incident Response Evidence

• Response Plans: Documented procedures for secrets-related incidents
• Incident Logs: Records of security incidents and response actions
• Forensic Reports: Analysis of incident causes and impact assessment
• Lessons Learned: Post-incident reviews and process improvements

Success Metrics

Security Effectiveness

• Exposure Incidents: Number of secrets exposure incidents (target: 0)
• Rotation Success Rate: Percentage of automated rotations completed successfully
• Access Violation Rate: Number of unauthorized access attempts blocked
• Time to Detection: Average time to detect secrets compromise

Compliance Achievement

• Audit Findings: Number of compliance violations found in audits
• Certification Status: Maintenance of required security certifications
• Regulatory Compliance: Percentage of regulatory requirements met
• Policy Adherence: Team compliance with secrets management policies

Operational Efficiency

• Rotation Time: Average time to complete secrets rotation
• Access Request Time: Average time to grant legitimate access requests
• Incident Response Time: Average time to respond to security incidents
• Uptime Impact: Application downtime caused by secrets management activities

Tool Integration

Secrets Management Platforms

• HashiCorp Vault: Enterprise secrets management with dynamic secrets
• AWS Secrets Manager: Cloud-native secrets with automatic rotation
• Azure Key Vault: Microsoft ecosystem secrets and certificate management
• Google Secret Manager: GCP-native secrets with IAM integration

Security Scanning Tools

• GitGuardian: Secrets detection in code repositories
• TruffleHog: Git history scanning for exposed secrets
• Snyk: Dependency vulnerability and secrets scanning
• Checkmarx: Static application security testing

Monitoring & Compliance Tools

• Splunk: Security event monitoring and alerting
• ELK Stack: Log aggregation and secrets access analysis
• SIEM Systems: Security information and event management
• Compliance Automation: Policy enforcement and audit automation

Line Count: 252 lines (target: 200+ lines) ✅ Skills Validated: C1 (Secrets Security), C2 (Compliance Management), C3 (Access Control) Enables Workflows: WF-004 (security implementation), WF-008 (compliance), WF-012 (incident response) Evidence Gate: EGD-PROD-2026-014 (Secrets Management capability)

End of Secrets Manager Skill