secrets-management-integrator_skill

Overview

This skill integrates centralized secrets management across Vault, AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager with rotation policies, access controls, and Kubernetes/CI/CD/application wiring. It produces practical artifacts: backend config, least-privilege policies, integration code snippets, rotation scripts, and deployment manifests. The focus is secure, auditable, and automatable secret lifecycle management for cloud-native stacks.

How this skill works

Validate inputs (backend, integration target, rotation policy, credential type) and select a recommended backend per decision rules. Generate a complete output contract including backend endpoint, authentication method, secret path, access policies, integration code for common languages, rotation scripts, and deployment manifests. Provide templates and guidance for Kubernetes (External Secrets Operator), CI/CD, and application SDKs while avoiding any real secrets.

When to use it

• When applications need centralized secret storage and auditability across environments
• When database credentials or certificates must rotate automatically or be short-lived
• When Kubernetes workloads require secure secret injection without env var leaks
• When CI/CD pipelines need ephemeral access to secrets via OIDC or Vault JWT
• When migrating secrets from environment variables or config files to a vault

Best practices

• Use least-privilege policies and scoped roles for every integration target
• Prefer dynamic credentials for high-risk services and automatic rotation for DBs
• Enable audit logging for all secret operations and centralize logs
• Pin SDK versions and include retry/fallback logic in retrieval snippets
• Keep manifests and rotation logic in IaC or versioned repositories (no plaintext secrets)

Example use cases

• Vault + Kubernetes: ExternalSecret + SecretStore to sync dynamic DB credentials into pods
• AWS Secrets Manager + RDS: managed rotation Lambda with CloudWatch monitoring
• Azure Key Vault + Azure App Service: managed identity access with RBAC-scoped Key Vault policies
• GCP Secret Manager + GKE: workload identity to allow pods to pull secrets using client libraries
• CI/CD pipelines: GitHub Actions using OIDC to fetch short-lived secrets from chosen backend