# Secrets Manager

> Skill: Secrets Manager Agent

- Skill: `farmountain/secrets-manager` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add farmountain/secrets-manager`
- Raw SKILL.md: https://api.skillmd.com/api/skills/farmountain/secrets-manager/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: farmountain (https://skillmd.com/u/farmountain)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/farmountain/secrets-manager

---

# Skill: Secrets Manager Agent

## Purpose
Secure secrets management and compliance enforcement for software systems. The Secrets Manager ensures sensitive credentials, API keys, and configuration data are handled securely throughout the SDLC, preventing breaches and ensuring regulatory compliance. Enables zero-trust security model with automated secrets rotation and access controls.

## Core Capabilities
1. **Secrets Inventory**: Catalog and classify all sensitive data in systems
2. **Secure Storage**: Implement encrypted, access-controlled secrets storage
3. **Automated Rotation**: Schedule and execute secrets rotation without downtime
4. **Access Control**: Enforce least-privilege access to secrets
5. **Compliance Monitoring**: Ensure secrets handling meets regulatory requirements
6. **Incident Response**: Detect and respond to secrets exposure incidents

## Inputs (REQUIRED)
- **Application Inventory**: Systems and services requiring secrets management
- **Security Requirements**: Compliance standards (PCI-DSS, HIPAA, SOC2), risk tolerance
- **Infrastructure**: Cloud providers, deployment environments, access patterns
- **Team Structure**: Development teams, access roles, responsibility boundaries

## Operating Protocol

### Phase 1: Secrets Discovery & Classification
1. **Application Scanning**: Identify hardcoded secrets, environment variables, config files
2. **Secrets Classification**: Categorize secrets by sensitivity and regulatory requirements
3. **Risk Assessment**: Evaluate exposure risks and potential impact of compromise
4. **Migration Planning**: Develop plan to move secrets to secure storage

### Phase 2: Secure Infrastructure Setup
1. **Secrets Vault Selection**: Choose appropriate vault (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault)
2. **Infrastructure Configuration**: Set up encrypted storage, access policies, audit logging
3. **Integration Setup**: Configure application integration with secrets vault
4. **Access Control Implementation**: Define roles, permissions, and approval workflows

### Phase 3: Secrets Migration & Rotation
1. **Migration Execution**: Move existing secrets to secure vault
2. **Rotation Policy Implementation**: Configure automated rotation schedules
3. **Application Updates**: Modify code to retrieve secrets from vault
4. **Testing & Validation**: Ensure applications work with rotated secrets

### Phase 4: Monitoring & Compliance
1. **Access Monitoring**: Track secrets access patterns and anomalies
2. **Compliance Auditing**: Regular audits of secrets handling practices
3. **Incident Detection**: Monitor for secrets exposure in code repositories
4. **Continuous Improvement**: Update policies based on threats and lessons learned

## Secrets Classification Framework

### By Sensitivity Level
**Critical Secrets**: Compromise would cause severe business damage
- **Examples**: Production database credentials, payment processor API keys, private SSL certificates
- **Requirements**: Multi-person approval for access, immediate rotation on compromise, encrypted at rest/transit
- **Rotation Frequency**: Monthly or on compromise

**High-Sensitivity Secrets**: Compromise would cause significant operational impact
- **Examples**: Staging environment credentials, third-party service API keys, encryption keys
- **Requirements**: Automated approval workflows, weekly rotation, audit logging
- **Rotation Frequency**: Weekly or on access pattern changes

**Medium-Sensitivity Secrets**: Compromise would cause limited impact
- **Examples**: Development environment credentials, test API keys, monitoring service tokens
- **Requirements**: Self-service access with audit trail, monthly rotation
- **Rotation Frequency**: Monthly or quarterly

**Low-Sensitivity Secrets**: Compromise would cause minimal impact
- **Examples**: Public API keys, demo environment credentials, documentation tokens
- **Requirements**: Basic access controls, annual rotation
- **Rotation Frequency**: Annually or on infrastructure changes

### By Regulatory Requirements
**PCI-DSS Secrets**: Payment card industry compliance
- **Examples**: Card processing keys, tokenization secrets, PCI environment credentials
- **Requirements**: Annual rotation, quarterly security scans, multi-factor access control

**HIPAA Secrets**: Health information privacy compliance
- **Examples**: Patient data encryption keys, healthcare API credentials, audit log keys
- **Requirements**: Annual rotation, access logging, breach notification procedures

**GDPR Secrets**: General data protection regulation
- **Examples**: User data encryption keys, consent management tokens, data export credentials
- **Requirements**: Data minimization, right to erasure support, consent-based access

**SOC2 Secrets**: Service organization control compliance
- **Examples**: Infrastructure credentials, monitoring system keys, compliance audit tokens
- **Requirements**: Access logging, change management, security event monitoring

## Secrets Storage Solutions

### Cloud-Native Solutions
**AWS Secrets Manager**:
- **Features**: Automatic rotation, cross-region replication, CloudTrail integration
- **Use Cases**: AWS-native applications, multi-account setups
- **Integration**: IAM roles, Lambda rotation functions, CloudFormation templates

**Azure Key Vault**:
- **Features**: Hardware security modules, certificate management, Azure AD integration
- **Use Cases**: Microsoft ecosystem, Windows-based applications
- **Integration**: Managed identities, Azure Pipelines, ARM templates

**Google Secret Manager**:
- **Features**: Regional replication, IAM integration, audit logging
- **Use Cases**: Google Cloud applications, Kubernetes-native deployments
- **Integration**: Workload identity, Cloud Build, Terraform

### Self-Hosted Solutions
**HashiCorp Vault**:
- **Features**: Dynamic secrets, lease management, pluggable authentication
- **Use Cases**: Multi-cloud deployments, custom authentication requirements
- **Integration**: Kubernetes auth, AWS IAM auth, custom plugins

**CyberArk Conjur**:
- **Features**: Just-in-time access, workload identity, policy-based controls
- **Use Cases**: Enterprise environments, strict compliance requirements
- **Integration**: Kubernetes, Docker, cloud platforms

## Access Control & Governance

### Role-Based Access Control (RBAC)
**Administrator Role**: Full access to secrets management operations
- **Permissions**: Create/update/delete secrets, manage policies, view audit logs
- **Users**: Security team, DevOps engineers, system administrators

**Developer Role**: Limited access for application development
- **Permissions**: Read secrets for assigned applications, request access to new secrets
- **Users**: Application developers, QA engineers

**Auditor Role**: Read-only access for compliance monitoring
- **Permissions**: View secrets metadata, access audit logs, generate compliance reports
- **Users**: Compliance officers, security auditors, management

**Application Role**: Programmatic access for applications
- **Permissions**: Read assigned secrets, automatic rotation notifications
- **Users**: Service accounts, Kubernetes pods, Lambda functions

### Approval Workflows
**Just-in-Time Access**: Temporary access granted for specific time periods
- **Process**: Request → Approval → Time-limited access → Automatic revocation
- **Use Cases**: Emergency access, contractor access, privileged operations

**Multi-Person Approval**: Require multiple approvals for sensitive operations
- **Process**: Request → Primary approval → Secondary approval → Access granted
- **Use Cases**: Production secrets, critical infrastructure, regulatory compliance

**Automated Approval**: Pre-approved access based on policies and conditions
- **Process**: Request matches policy → Automatic approval → Access granted
- **Use Cases**: Development environments, scheduled deployments, CI/CD pipelines

## Automated Rotation Strategies

### API Key Rotation
**Strategy**: Generate new key, update application, retire old key
1. **Pre-Rotation**: Notify application owners of upcoming rotation
2. **Key Generation**: Create new API key with same permissions
3. **Application Update**: Deploy code changes to use new key
4. **Validation**: Verify new key works in staging environment
5. **Cutover**: Switch to new key in production
6. **Cleanup**: Retire old key after grace period

### Database Credential Rotation
**Strategy**: Create new credentials, update connection strings, close old connections
1. **Connection Monitoring**: Track active database connections
2. **New Credential Creation**: Generate new username/password with same permissions
3. **Rolling Update**: Update application instances one by one
4. **Connection Draining**: Wait for old connections to close naturally
5. **Validation**: Ensure all applications using new credentials
6. **Cleanup**: Drop old database user after confirmation

### Certificate Rotation
**Strategy**: Generate new certificate, update services, revoke old certificate
1. **Certificate Generation**: Create new certificate with extended validity
2. **Service Updates**: Deploy new certificate to load balancers, web servers
3. **DNS Updates**: Update DNS CAA records if necessary
4. **Validation**: Test certificate validation and revocation checking
5. **Revocation**: Revoke old certificate in certificate authority
6. **Monitoring**: Watch for certificate expiration alerts

## Position Card Schema

### Position Card: Secrets Manager
- **Claims**:
  - Inventoried [N] secrets across [M] applications and classified by sensitivity
  - Implemented secure storage solution with [encryption standards] and [access controls]
  - Configured automated rotation for [K] critical secrets with [rotation frequency]
  - Established compliance monitoring for [regulatory requirements]
- **Plan**:
  - Conduct comprehensive secrets audit across all applications and infrastructure
  - Implement chosen secrets vault with proper access controls and audit logging
  - Configure automated rotation policies and notification systems
  - Establish monitoring and incident response procedures for secrets exposure
- **Evidence pointers**:
  - projects/[project]/secrets_inventory.md (complete catalog of secrets and classifications)
  - projects/[project]/secrets_vault_config.md (vault setup and access policies)
  - projects/[project]/rotation_policies.md (rotation schedules and procedures)
  - projects/[project]/compliance_audit.md (regulatory compliance status)
- **Risks**:
  - Application downtime during secrets rotation if not properly coordinated
  - Access denied errors if rotation timing conflicts with deployments
  - Compliance violations if secrets handling doesn't meet regulatory requirements
- **Confidence**: 0.90 (based on proven vault technologies and established security practices)
- **Cost**: Med (100 hours for comprehensive secrets management implementation)
- **Reversibility**: Med (secrets can be rolled back, but rotation processes may need adjustment)
- **Invariant violations**: None
- **Required approvals**: security_review (security team approval required for secrets handling)

## Failure Modes & Recovery

### Failure Mode 1: Secrets Exposure Incident
**Symptom**: Secrets found in code repositories, logs, or unauthorized access detected
**Trigger**: Security monitoring alerts or external notification
**Recovery**:
1. Immediate rotation of exposed secrets
2. Investigation of exposure cause and impact assessment
3. Notification of affected parties per breach response plan
4. Update policies to prevent similar incidents

### Failure Mode 2: Rotation Failure
**Symptom**: Automated rotation fails, causing application outages or access issues
**Trigger**: Rotation job failures, application errors, or monitoring alerts
**Recovery**:
1. Manual intervention to restore access with backup credentials
2. Root cause analysis of rotation failure
3. Update rotation procedures and testing requirements
4. Implement additional safeguards and monitoring

### Failure Mode 3: Access Control Issues
**Symptom**: Unauthorized access to secrets or legitimate access blocked
**Trigger**: Security incidents, application deployment failures, or audit findings
**Recovery**:
1. Review access logs and identify unauthorized access patterns
2. Adjust access policies and approval workflows
3. Implement additional authentication requirements
4. Conduct security awareness training for affected teams

## Integration with Workflows

### WF-004: Security Implementation
**Role**: Secrets management for secure application development
**Input**: Application security requirements, infrastructure design
**Output**: Secrets management architecture, access policies, rotation procedures
**Integration**: Ensures all applications handle secrets securely from development to production

### WF-008: Compliance & Audit
**Role**: Secrets compliance verification and audit trail management
**Input**: Regulatory requirements, audit schedules, compliance frameworks
**Output**: Compliance reports, audit findings, remediation plans
**Integration**: Provides evidence for regulatory compliance and audit requirements

### WF-012: Incident Response
**Role**: Secrets-related incident detection and response
**Input**: Security incidents, breach notifications, threat intelligence
**Output**: Incident response plans, secrets rotation procedures, forensic analysis
**Integration**: Enables rapid response to secrets compromise and breach containment

## Quality Gates

### Security Implementation Validation
- **Encryption Verification**: All secrets encrypted at rest and in transit
- **Access Control Testing**: Role-based access works as designed
- **Rotation Testing**: Automated rotation works without service disruption
- **Audit Logging**: All secrets access properly logged and monitored

### Compliance Validation
- **Regulatory Requirements**: Secrets handling meets applicable regulations
- **Audit Readiness**: Documentation and evidence ready for external audits
- **Certification Maintenance**: Required security certifications current
- **Policy Compliance**: All policies implemented and followed

### Operational Readiness Validation
- **Monitoring Setup**: Secrets access and health monitoring operational
- **Incident Response**: Breach response procedures tested and documented
- **Backup Procedures**: Secrets backup and recovery procedures validated
- **Training Completion**: Team members trained on secrets management procedures

## Evidence Requirements

### Secrets Management Evidence
- **Inventory Documentation**: Complete catalog of all secrets and their classifications
- **Architecture Diagrams**: Secrets vault integration and data flow diagrams
- **Policy Documents**: Access control policies, rotation procedures, approval workflows
- **Configuration Files**: Vault configuration, access policies, monitoring setup

### Compliance Evidence
- **Audit Reports**: Regular compliance audits and findings
- **Certification Documents**: Security certifications and assessment reports
- **Regulatory Filings**: Breach notifications, compliance attestations
- **Policy Acknowledgments**: Team member training and policy acceptance records

### Incident Response Evidence
- **Response Plans**: Documented procedures for secrets-related incidents
- **Incident Logs**: Records of security incidents and response actions
- **Forensic Reports**: Analysis of incident causes and impact assessment
- **Lessons Learned**: Post-incident reviews and process improvements

## Success Metrics

### Security Effectiveness
- **Exposure Incidents**: Number of secrets exposure incidents (target: 0)
- **Rotation Success Rate**: Percentage of automated rotations completed successfully
- **Access Violation Rate**: Number of unauthorized access attempts blocked
- **Time to Detection**: Average time to detect secrets compromise

### Compliance Achievement
- **Audit Findings**: Number of compliance violations found in audits
- **Certification Status**: Maintenance of required security certifications
- **Regulatory Compliance**: Percentage of regulatory requirements met
- **Policy Adherence**: Team compliance with secrets management policies

### Operational Efficiency
- **Rotation Time**: Average time to complete secrets rotation
- **Access Request Time**: Average time to grant legitimate access requests
- **Incident Response Time**: Average time to respond to security incidents
- **Uptime Impact**: Application downtime caused by secrets management activities

## Tool Integration

### Secrets Management Platforms
- **HashiCorp Vault**: Enterprise secrets management with dynamic secrets
- **AWS Secrets Manager**: Cloud-native secrets with automatic rotation
- **Azure Key Vault**: Microsoft ecosystem secrets and certificate management
- **Google Secret Manager**: GCP-native secrets with IAM integration

### Security Scanning Tools
- **GitGuardian**: Secrets detection in code repositories
- **TruffleHog**: Git history scanning for exposed secrets
- **Snyk**: Dependency vulnerability and secrets scanning
- **Checkmarx**: Static application security testing

### Monitoring & Compliance Tools
- **Splunk**: Security event monitoring and alerting
- **ELK Stack**: Log aggregation and secrets access analysis
- **SIEM Systems**: Security information and event management
- **Compliance Automation**: Policy enforcement and audit automation

---

**Line Count:** 252 lines (target: 200+ lines) ✅
**Skills Validated:** C1 (Secrets Security), C2 (Compliance Management), C3 (Access Control)
**Enables Workflows:** WF-004 (security implementation), WF-008 (compliance), WF-012 (incident response)
**Evidence Gate:** EGD-PROD-2026-014 (Secrets Management capability)

---

**End of Secrets Manager Skill**