secrets-management

Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools. Implement secure secrets management in CI/CD pipelines without hardcoding sensitive information. Reference: See references/vault-setup.md Reference: See references/github-secrets.md - Store API keys and credentials - Manage database passwords - Handle TLS certificates - Rotate secrets automatically - Implement least-privilege access - Centralized secrets management - Dynamic secrets generation - Secret rotation - Audit logging - Fine-grained access control - AWS-native solution - Automatic rotation - Integration with RDS - CloudFormation support - Azure-native solution - HSM-backed keys - Certificate management - RBAC integration - GCP-native solution - Versioning - IAM integration - Protected: Only available in protected branches - Masked: Hidden in job logs - File type: Stored as file - Never commit secrets to Git - Use different secrets per environment - Rotate secrets regularly - Implement least-privilege access - Enable audit logging - Use secret scanning (GitGuardian, TruffleHog) - Mask secrets in logs - Encrypt secrets at rest - Use short-lived tokens when possible - Document secret requirements - Generate new secret - Update secret in secret store - Update applications to use new secret - Verify functionality - Revoke old secret - github-actions-templates - For...