A secrets manager securely stores and manages credentials that infrastructure and delivery systems need, including passwords, certificates, private keys, SSH keys, and API tokens. section 2.3.6 section 8.1
Use a secrets manager to:
- Keep secrets outside infrastructure-as-code and version control rather than hardcoding them in plaintext. section 2.3.6
- Pass secrets into IaC as variables and use them in memory during configuration. section 2.3.6
- Rotate credentials and certificates centrally, then rerun IaC to apply updated values. section 2.3.6 section 8.1
- Limit pipeline credentials and prevent sensitive values from appearing in logs. section 8.1
Certificate renewal
Store a load balancer certificate in the secrets manager, pass it to IaC as an input variable, and update the stored value when the certificate changes. Separating certificate management from resource configuration avoids expired encrypted inputs. section 2.3.6
Figure 2.10 Retrieve sensitive information from a secrets manager to change resources with an infrastructure provider.
Shows how an infrastructure provider retrieves sensitive information from a secrets manager to change resources. section 2.3.6
