secrets-management

The Secrets Management skill provides secure handling of sensitive credentials and secrets within CI/CD pipelines using tools such as HashiCorp Vault, AWS Secrets Manager, and native platform solutions like Azure Key Vault and Google Secret Manager. It addresses the critical problem of avoiding hard-coded secrets in code repositories, ensuring that API keys, passwords, and certificates are managed safely and rotated regularly. By centralizing secret storage and providing controlled access, this skill helps mitigate security risks and enforces compliance with best practices in automated deployment workflows.

Key features of this skill include centralized secret storage, dynamic secret generation, automated rotation, fine-grained access control, and audit logging. For AWS users, integration with RDS and CloudFormation is supported, while Azure users can leverage HSM-backed key storage and RBAC integration. Google Secret Manager provides versioning and IAM integration. Additionally, the skill includes practical examples for integrating Vault with GitHub Actions and GitLab CI, as well as handling AWS Secrets Manager secrets using GitHub Actions and Terraform. It also covers using platform-specific CI/CD secrets like GitHub repository secrets and GitLab project variables, including protected and masked variables.

Typical use cases include storing API keys, managing database credentials, handling TLS certificates, and implementing automated secret rotation within CI/CD pipelines. Target users are DevOps engineers, platform engineers, and software developers who need to secure deployment pipelines and manage sensitive information efficiently. This skill is particularly valuable for organizations aiming to enforce least-privilege access and maintain robust security practices in automated infrastructure and application deployments.