Secrets

A secret is a set of sensitive information, such as credentials, cloud access keys or key/value pairs used in DevOps environment, which grants access to systems like databases, API servers, cloud services, and others. Developers and Security Teams often have difficulties managing those sensitive data on environments like CI/CD pipelines, Infrastructure-as-a-Code (IaaC), automation tools such as Ansible, or even hard-coded inside application dependencies. DevOps Secret Management module offers an easy-to-use way of managing secrets on those environments through a user-friendly interface, centralizing sensitive data in a secure and encrypted vault.

The DSM module current supports Credentials with username and password, as well as SSH Keys (through integration with PAM Core module), Cloud Credentials (through integration with Cloud IAM module), Ephemeral Credentials (through Dynamic Provision) and Key/Value pairs as secret data.

The secrets can be queried by applications or scripts through API calls using authorizations as access policies and can be injected on systems and environments through automations created directly in senhasegura, where the secrets will be created, updated and deleted without the need to change the application code.

Register a Secret

To register a secret, follow the menu DevOps Secret Manager ➔ Secret Management ➔ Secrets.

1. In the report's action button, click on New secret;
2. In the Settings tab, fill in the following fields:
   • Name: Name of the secret for management within senhasegura DSM;
   • Identity: Unique secret identifier used to query its data;
   • Enabled: Whether this secret is available to be used by applications;
   • Engine: Engine to be used. This information is used only for audit purposes;
   • Expiration date:Date/time on which the secret will be automatically inactivated;
     Important

     When the information expires, it is deleted. Some information such as access keys cannot be recovered.
   • Tags: User-defined tags for data segregation and internal filters for secrets in senhasegura;
   • Description: Secret usage description. Will not be used by applications.
3. In the Cloud Credentials tab, select the cloud credentials that will be part of the secret;

4. In the Credentials tab, select the credentials that will be part of the secret;
5. In the Ephemeral Credentials tab, select the dynamic credentials that will be part of the secret;
6. In the Key/Value tab, provide a key name and sensitive value pair.
7. In the Auto-renewal tab, select whether to:
   • Enable/disable secret data renewal for Cloud Credentials, Credentials and Ephemeral Credentials;
   • Determine an interval in minutes to renew data for Cloud Credentials, Credentials and Ephemeral Credentials;
8. To finish, click on Save;

 

View a Secret

To view the list of all secrets and its data, follow the menu DSM ➔Secret Management ➔Secrets.

On this screen, you can view the existing secrets along with information such as engine, identifier, status, version and expiration date.

You can click on the Action icon to view the details and edit the configuration of the secret. 

Info

The password view will only be possible by accessing the credential screen (PAM Core or Cloud IAM) according to the safety procedures of the module. 

 

 

View a Secret Version

To view the secret's history, follow the menu DevOps Secret Manager ➔ Secret Management ➔ Secrets.

1. In the actions of a secret, click on More options, then Show versions;
2. In the presented screen, click on View history for the desired version;
3. Use the eye icon button to view specific data of that secret version;

Secret History

 

View a secret's error history

To view, follow the menu: DevOps Secret Manager ➔ Secrets Management ➔ Secrets.

On the action button, select the secret. The option to see error will only be shown if an error actually occurs.