<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-cloud-secrets-management
description: >-
  Implement secure secrets management using HashiCorp Vault, AWS Secrets Manager,
  GCP Secret Manager, Kubernetes External Secrets Operator, and CSI Secret Store
  Driver to eliminate hardcoded credentials and environment variable secrets.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - vault
  - secrets-manager
  - csi-driver
  - external-secrets
  - credential-management
  - key-rotation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1552"]
---

# Implementing Cloud Secrets Management

## Overview

Hardcoded secrets in code, config files, and environment variables are a top
breach vector. This skill covers centralized secrets management with Vault,
cloud-native secret services, and Kubernetes integration patterns that inject
secrets at runtime without exposing them in pod specs.

Mode: `[MODE: ARCHITECT]` — Secrets architecture design. `[MODE: BLUE]` — Secrets audit and hardening.

## Prerequisites

| Requirement | Details |
|---|---|
| HashiCorp Vault >= 1.15 (optional) | Required |
| AWS Secrets Manager / GCP Secret Manager access | Required |
| Kubernetes CSI Secret Store Driver or External Secrets Operator | Required |
| kubectl with cluster access | Required |

## Key Concepts

### HashiCorp Vault with Kubernetes

```bash
# Install Vault via Helm
helm repo add hashicorp https://helm.releases.hashicorp.com
helm install vault hashicorp/vault -n vault --create-namespace \
  --set server.dev.enabled=false \
  --set injector.enabled=true

# Enable Kubernetes auth
vault auth enable kubernetes
vault write auth/kubernetes/config \
  kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443"

# Create secret
vault kv put secret/myapp/config db_password="supersecret" api_key="key123"

# Create policy
vault policy write myapp-read - <<EOF
path "secret/data/myapp/*" {
  capabilities = ["read"]
}
EOF

# Create K8s auth role
vault write auth/kubernetes/role/myapp \
  bound_service_account_names=myapp \
  bound_service_account_namespaces=production \
  policies=myapp-read \
  ttl=1h
```

### Vault Agent Injector (Pod Annotations)

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: myapp
  annotations:
    vault.hashicorp.com/agent-inject: "true"
    vault.hashicorp.com/role: "myapp"
    vault.hashicorp.com/agent-inject-secret-config: "secret/data/myapp/config"
    vault.hashicorp.com/agent-inject-template-config: |
      {{- with secret "secret/data/myapp/config" -}}
      DB_PASSWORD={{ .Data.data.db_password }}
      API_KEY={{ .Data.data.api_key }}
      {{- end -}}
spec:
  serviceAccountName: myapp
  containers:
  - name: app
    image: myapp:latest
```

### AWS Secrets Manager

```bash
# Create secret
aws secretsmanager create-secret --name myapp/db-password \
  --secret-string '{"username":"admin","password":"secure123"}'

# Retrieve secret
aws secretsmanager get-secret-value --secret-id myapp/db-password --output json

# Enable rotation
aws secretsmanager rotate-secret --secret-id myapp/db-password \
  --rotation-lambda-arn arn:aws:lambda:REGION:ACCOUNT:function:rotate-secret \
  --rotation-rules AutomaticallyAfterDays=30

# List all secrets
aws secretsmanager list-secrets --output json
```

### Kubernetes CSI Secret Store Driver

```yaml
# SecretProviderClass for AWS
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: aws-secrets
spec:
  provider: aws
  parameters:
    objects: |
      - objectName: "myapp/db-password"
        objectType: "secretsmanager"

---
# Pod using CSI volume
apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
  - name: app
    image: myapp:latest
    volumeMounts:
    - name: secrets
      mountPath: "/mnt/secrets"
      readOnly: true
  volumes:
  - name: secrets
    csi:
      driver: secrets-store.csi.k8s.io
      readOnly: true
      volumeAttributes:
        secretProviderClass: "aws-secrets"
```

### External Secrets Operator

```yaml
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: myapp-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secretsmanager
    kind: ClusterSecretStore
  target:
    name: myapp-secret
  data:
  - secretKey: db-password
    remoteRef:
      key: myapp/db-password
      property: password
```

## Workflow

```bash
node scripts/agent.js --action audit --namespace production --output /tmp/secrets-audit.json
cat /tmp/secrets-audit.json | jq '.findings[]'
```

## Detection

```yaml
title: Cloud Secrets Management Detection
id: 3c91a470-5bb9-4206-b44d-e33519a5a3ad
status: experimental
description: Detects suspicious activity related to implementing cloud secrets management techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1552
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Secrets Management Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1552 |

## Verification

- [ ] No secrets in environment variables (use CSI driver or Vault injector)
- [ ] No secrets in Git repos (gitleaks clean)
- [ ] Vault policies follow least privilege
- [ ] Secret rotation enabled (<=90 day rotation)
- [ ] K8s Secrets encrypted at rest (KMS encryption)
- [ ] External Secrets Operator or CSI driver deployed

## References

- [HashiCorp Vault K8s Integration](https://developer.hashicorp.com/vault/docs/platform/k8s)
- [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/)
- [K8s Secrets Store CSI Driver](https://secrets-store-csi-driver.sigs.k8s.io/)
- [External Secrets Operator](https://external-secrets.io/)
