← Back to all products

Secrets Management Guide

$29

HashiCorp Vault setup, AWS Secrets Manager patterns, rotation scripts, and zero-trust secrets architecture.

📁 27 files
MarkdownTOMLShellJSONYAMLPythonAWSGitHub ActionsCI/CD

📄 Product Preview

Try the interactive reader and demo tools below, or get the full product with all content unlocked.

📖 Interactive Reader (Free Preview) ⚙ Try Demo Tools 📦 Download Free Sample

📁 File Structure 27 files

secrets-management-guide/ ├── LICENSE ├── README.md ├── aws/ │ ├── iam-policy-secrets-read.json │ ├── rotation_lambda.py │ └── secrets-manager-patterns.md ├── ci/ │ └── secrets-scan.yml ├── docs/ │ ├── migration-off-plaintext.md │ ├── rotation-runbook.md │ └── vault-setup-guide.md ├── examples/ │ └── sample-scan-output.txt ├── free-sample.zip ├── guide/ │ ├── 01-why-secrets-management-matters.md │ ├── 02-hashicorp-vault-deployment.md │ ├── 03-aws-secrets-manager-patterns.md │ ├── 04-secret-detection-and-ci-integration.md │ └── 05-rotation-strategies-and-migration.md ├── index.html ├── scripts/ │ ├── detect_committed_secrets.sh │ ├── rotate_secret.py │ └── scan_secrets.py └── vault/ ├── dynamic-db-secrets.sh ├── policies/ │ ├── app-read.hcl │ ├── ci-deploy.hcl │ └── rotation-operator.hcl ├── server.hcl └── setup-vault.sh

📖 Documentation Preview README excerpt

Secrets Management Guide

A hands-on, code-forward kit for getting secrets out of plaintext and under

real control: HashiCorp Vault setup and least-privilege policies, AWS Secrets

Manager patterns, automated rotation, dynamic database credentials, safe

secret handling in CI, detecting secrets already committed to git, and a staged

migration off plaintext that doesn't cause an outage.

Everything here is anonymized and uses placeholders (<VAULT_TOKEN>, RFC1918

addresses, the example AWS account 111122223333). Nothing in this kit contains

a real secret — and a bundled scanner helps make sure yours never ship either.

Who this is for

Platform/DevOps engineers, SREs, and security engineers who own — or are about

to own — how an organization stores, distributes, rotates, and audits secrets.

You should be comfortable on a Linux shell and with one cloud provider. No prior

Vault experience required; the setup guide starts from operator init.

What you get

  • A production-shaped Vault server config and three **least-privilege

policies** (app-read, ci-deploy, rotation-operator) with explicit denies.

  • A bootstrap script that initialises Vault, enables audit logging first,

mounts the core engines, and loads the policies.

  • A dynamic database secrets script that replaces shared DB passwords with

per-request, auto-expiring users — and rotates the bootstrap password away.

  • A complete, annotated AWS Secrets Manager rotation Lambda implementing the

four-step staged rotation contract, plus a least-privilege IAM policy.

  • A dependency-free secret scanner (regex + Shannon entropy) and a **history

scanner wrapper driving gitleaks/trufflehog, wired into a CI workflow**.

  • A pluggable rotation orchestrator for the static secrets that don't fit

dynamic engines, with generate → apply → verify → rollback semantics.

  • Three substantial guides: Vault setup, a rotation runbook (scheduled,

emergency, rollback), and a migration-off-plaintext playbook.

Prerequisites

ToolWhyNotes
Vault CLI ≥ 1.13server config, policies, enginesthe scripts call vault
Bash ≥ 4the .sh scriptssetup-vault.sh, etc.
Python ≥ 3.10the scanners + orchestratorstdlib only, no pip install
AWS CLI + boto3Secrets Manager patternsonly for the AWS portions
gitleaks or trufflehoghistory scanningoptional; scanner falls back

The Python tools (scan_secrets.py, rotate_secret.py) require **no external

packages**. The AWS rotation Lambda uses boto3, which the AWS Lambda runtime

provides — no install needed there either.

Quick start


# 1. Scan a repo for secrets right now (no setup needed):

*... continues with setup instructions, usage examples, and more.*

📄 Code Sample .sh preview

scripts/detect_committed_secrets.sh#!/usr/bin/env bash # ============================================================================= # detect_committed_secrets.sh — find secrets already committed to git history. # ----------------------------------------------------------------------------- # The dependency-free scan_secrets.py catches secrets in the WORKING TREE. This # wrapper drives the two best open-source history scanners — gitleaks and # trufflehog — to catch secrets buried in PAST commits (the ones that already # leaked and need credential rotation, not just deletion). # # It auto-detects whichever tool is installed, runs a full-history scan, and # exits non-zero on findings so CI can block. If neither tool is present it # falls back to the bundled stdlib scanner over the working tree. # # Install (pick one): # gitleaks: https://github.com/gitleaks/gitleaks (single Go binary) # trufflehog: https://github.com/trufflesecurity/trufflehog # # Usage: # ./detect_committed_secrets.sh # scan repo at CWD, full history # ./detect_committed_secrets.sh /path/to/repo # scan another repo # REPORT_DIR=./reports ./detect_committed_secrets.sh # ============================================================================= set -euo pipefail REPO="${1:-$(pwd)}" REPORT_DIR="${REPORT_DIR:-./secret-scan-reports}" CONFIG="${GITLEAKS_CONFIG:-$(dirname "$0")/../ci/.gitleaks.toml}" SELF_DIR="$(cd "$(dirname "$0")" && pwd)" log() { printf '[secret-history] %s\n' "$*" >&2; } fail() { printf '[secret-history][ERROR] %s\n' "$*" >&2; exit 1; } [ -d "${REPO}/.git" ] || fail "Not a git repository: ${REPO}" mkdir -p "${REPORT_DIR}" run_gitleaks() { log "Running gitleaks over full history of ${REPO}" local report="${REPORT_DIR}/gitleaks-report.json" local args=(detect --source "${REPO}" --report-format json --report-path "${report}" --redact) if [ -f "${CONFIG}" ]; then
Buy Now — $29 Back to Products