thesoftwarehouse/copilot-collections/tsh-managing-secrets

Secrets Management

When to Use

• Storing application credentials securely
• Configuring CI/CD authentication
• Implementing secrets rotation
• Setting up GitOps-compatible secret management

Solution Decision Matrix

Cloud-Native Detection

Check which cloud provider the project uses:

• *.tf with provider "aws" → AWS Secrets Manager
• *.tf with provider "azurerm" → Azure Key Vault
• *.tf with provider "google" → GCP Secret Manager

Use context7 or cloud documentation MCP to look up provider-specific syntax.

Kubernetes Secrets Detection

Check for existing patterns:

• SealedSecret resources → Bitnami Sealed Secrets
• ExternalSecret resources → External Secrets Operator
• *.enc.yaml files → SOPS encryption
• vault-agent sidecars → HashiCorp Vault

CI/CD Credentials Decision

Rule: Always prefer OIDC federation over long-lived access keys.

Process

1. Discover context → Check existing secret patterns in codebase
2. Choose solution → Use decision matrix based on scenario
3. Look up implementation → Use context7 or cloud MCP for current syntax
4. Implement rotation → Set rotation policy (30-90 days for credentials)
5. Enable auditing → Configure access logging on secret store
6. Document break-glass → Define emergency access procedure

Security Checklist

• [ ] No secrets in code, environment variables visible in UI, or logs
• [ ] Rotation policy defined (30-90 days for credentials)
• [ ] Least privilege access to secret stores
• [ ] Audit logging enabled on all secret access
• [ ] OIDC used for CI/CD (no long-lived access keys)
• [ ] Secrets encrypted at rest and in transit
• [ ] Break-glass procedure documented
• [ ] Secret scanning enabled in CI (gitleaks, trufflehog)

Anti-Patterns

Related Skills

• tsh-implementing-ci-cd - For pipeline credential setup
• tsh-implementing-terraform-modules - For IaC secret resource patterns
• tsh-optimizing-cloud-cost - Secret manager pricing considerations