{"id":"secrets-management","name":"secrets-management","summary":"Vault、AWS Secrets Manager、またはネイティブプラットフォームソリューションを用いて、CI/CDパイプラインに対して安全なシークレット管理を実装してください。","body":"# Secrets Management\n\nSecure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.\n\n## Purpose\n\nImplement secure secrets management in CI/CD pipelines without hardcoding sensitive information.\n\n## When to Use\n\n- Store API keys and credentials\n- Manage database passwords\n- Handle TLS certificates\n- Rotate secrets automatically\n- Implement least-privilege access\n\n## Secrets Management Tools\n\n### HashiCorp Vault\n\n- Centralized secrets management\n- Dynamic secrets generation\n- Secret rotation\n- Audit logging\n- Fine-grained access control\n\n### AWS Secrets Manager\n\n- AWS-native solution\n- Automatic rotation\n- Integration with RDS\n- CloudFormation support\n\n### Azure Key Vault\n\n- Azure-native solution\n- HSM-backed keys\n- Certificate management\n- RBAC integration\n\n### Google Secret Manager\n\n- GCP-native solution\n- Versioning\n- IAM integration\n\n## HashiCorp Vault Integration\n\n### Setup Vault\n\n```bash\n# Start Vault dev server\nvault server -dev\n\n# Set environment\nexport VAULT_ADDR='http://127.0.0.1:8200'\nexport VAULT_TOKEN='root'\n\n# Enable secrets engine\nvault secrets enable -path=secret kv-v2\n\n# Store secret\nvault kv put secret/database/config username=admin password=secret\n```\n\n### GitHub Actions with Vault\n\n```yaml\nname: Deploy with Vault Secrets\n\non: [push]\n\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - name: Import Secrets from Vault\n        uses: hashicorp/vault-action@v2\n        with:\n          url: https://vault.example.com:8200\n          token: ${{ secrets.VAULT_TOKEN }}\n          secrets: |\n            secret/data/database username | DB_USERNAME ;\n            secret/data/database password | DB_PASSWORD ;\n            secret/data/api key | API_KEY\n\n      - name: Use secrets\n        run: |\n          echo \"Connecting to database as $DB_USERNAME\"\n          # Use $DB_PASSWORD, $API_KEY\n```\n\n### GitLab CI with Vault\n\n```yaml\ndeploy:\n  image: vault:1.17\n  before_script:\n    - export VAULT_ADDR=https://vault.example.com:8200\n    - export VAULT_TOKEN=$VAULT_TOKEN\n    - apk add curl jq\n  script:\n    - |\n      DB_PASSWORD=$(vault kv get -field=password secret/database/config)\n      API_KEY=$(vault kv get -field=key secret/api/credentials)\n      echo \"Deploying with secrets...\"\n      # Use $DB_PASSWORD, $API_KEY\n```\n\n**Reference:** See `references/vault-setup.md`\n\n## AWS Secrets Manager\n\n### Store Secret\n\n```bash\naws secretsmanager create-secret \\\n  --name production/database/password \\\n  --secret-string \"super-secret-password\"\n```\n\n### Retrieve in GitHub Actions\n\n```yaml\n- name: Configure AWS credentials\n  uses: aws-actions/configure-aws-credentials@v4\n  with:\n    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}\n    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}\n    aws-region: us-west-2\n\n- name: Get secret from AWS\n  run: |\n    SECRET=$(aws secretsmanager get-secret-value \\\n      --secret-id production/database/password \\\n      --query SecretString \\\n      --output text)\n    echo \"::add-mask::$SECRET\"\n    echo \"DB_PASSWORD=$SECRET\" >> $GITHUB_ENV\n\n- name: Use secret\n  run: |\n    # Use $DB_PASSWORD\n    ./deploy.sh\n```\n\n### Terraform with AWS Secrets Manager\n\n```hcl\ndata \"aws_secretsmanager_secret_version\" \"db_password\" {\n  secret_id = \"production/database/password\"\n}\n\nresource \"aws_db_instance\" \"main\" {\n  allocated_storage    = 100\n  engine              = \"postgres\"\n  instance_class      = \"db.t3.large\"\n  username            = \"admin\"\n  password            = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)[\"password\"]\n}\n```\n\n## GitHub Secrets\n\n### Organization/Repository Secrets\n\n```yaml\n- name: Use GitHub secret\n  env:\n    API_KEY: ${{ secrets.API_KEY }}\n    DATABASE_URL: ${{ secrets.DATABASE_URL }}\n  run: |\n    # Secrets are injected as env vars — never print them to logs\n    ./deploy.sh\n```\n\n### Environment Secrets\n\n```yaml\ndeploy:\n  runs-on: ubuntu-latest\n  environment: production\n  steps:\n    - name: Deploy\n      env:\n        PROD_API_KEY: ${{ secrets.PROD_API_KEY }}\n      run: |\n        # Secret injected as env var — never print to logs\n        ./deploy.sh\n```\n\n**Reference:** See `references/github-secrets.md`\n\n## GitLab CI/CD Variables\n\n### Project Variables\n\n```yaml\ndeploy:\n  script:\n    - echo \"Deploying with $API_KEY\"\n    - echo \"Database: $DATABASE_URL\"\n```\n\n### Protected and Masked Variables\n\n- Protected: Only available in protected branches\n- Masked: Hidden in job logs\n- File type: Stored as file\n\n## Best Practices\n\n1. **Never commit secrets** to Git\n2. **Use different secrets** per environment\n3. **Rotate secrets regularly**\n4. **Implement least-privilege access**\n5. **Enable audit logging**\n6. **Use secret scanning** (GitGuardian, TruffleHog)\n7. **Mask secrets in logs**\n8. **Encrypt secrets at rest**\n9. **Use short-lived tokens** when possible\n10. **Document secret requirements**\n\n## Secret Rotation\n\n### Automated Rotation with AWS\n\n```python\nimport boto3\nimport json\n\ndef lambda_handler(event, context):\n    client = boto3.client('secretsmanager')\n\n    # Get current secret\n    response = client.get_secret_value(SecretId='my-secret')\n    current_secret = json.loads(response['SecretString'])\n\n    # Generate new password\n    new_password = generate_strong_password()\n\n    # Update database password\n    update_database_password(new_password)\n\n    # Update secret\n    client.put_secret_value(\n        SecretId='my-secret',\n        SecretString=json.dumps({\n            'username': current_secret['username'],\n            'password': new_password\n        })\n    )\n\n    return {'statusCode': 200}\n```\n\n### Manual Rotation Process\n\n1. Generate new secret\n2. Update secret in secret store\n3. Update applications to use new secret\n4. Verify functionality\n5. Revoke old secret\n\n## External Secrets Operator\n\n### Kubernetes Integration\n\n```yaml\napiVersion: external-secrets.io/v1beta1\nkind: SecretStore\nmetadata:\n  name: vault-backend\n  namespace: production\nspec:\n  provider:\n    vault:\n      server: \"https://vault.example.com:8200\"\n      path: \"secret\"\n      version: \"v2\"\n      auth:\n        kubernetes:\n          mountPath: \"kubernetes\"\n          role: \"production\"\n\n---\napiVersion: external-secrets.io/v1beta1\nkind: ExternalSecret\nmetadata:\n  name: database-credentials\n  namespace: production\nspec:\n  refreshInterval: 1h\n  secretStoreRef:\n    name: vault-backend\n    kind: SecretStore\n  target:\n    name: database-credentials\n    creationPolicy: Owner\n  data:\n    - secretKey: username\n      remoteRef:\n        key: database/config\n        property: username\n    - secretKey: password\n      remoteRef:\n        key: database/config\n        property: password\n```\n\n## Secret Scanning\n\n### Pre-commit Hook\n\n```bash\n#!/bin/bash\n# .git/hooks/pre-commit\n\n# Check for secrets with TruffleHog\ndocker run --rm -v \"$(pwd):/repo\" \\\n  trufflesecurity/trufflehog:3.88 \\\n  filesystem --directory=/repo\n\nif [ $? -ne 0 ]; then\n  echo \"❌ Secret detected! Commit blocked.\"\n  exit 1\nfi\n```\n\n### CI/CD Secret Scanning\n\n```yaml\nsecret-scan:\n  stage: security\n  image: trufflesecurity/trufflehog:3.88\n  script:\n    - trufflehog filesystem .\n  allow_failure: false\n```\n\n\n## Related Skills\n\n- `github-actions-templates` - For GitHub Actions integration\n- `gitlab-ci-patterns` - For GitLab CI integration\n- `deployment-pipeline-design` - For pipeline architecture","author":"@wshobson","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/wshobson/agents/tree/main/plugins/cicd-automation/skills/secrets-management","license":"MIT","category":"review","lang":"en","tokens":1793,"stars":0,"calls30d":2,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":["vault.example.com"]}}