Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Before & after
Same prompt, same agent — the only difference is the skill.
Setting up secret management is important for security and is definitely something you should do early. You have several options—HashiCorp Vault is a popular choice, and there are also managed cloud solutions like AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager. Each has different trade-offs around complexity, cost, and features. You'll want to think about secret rotation, audit logging, access control policies, and how secrets get injected into your applications. The right choice depends on your cloud provider, team size, compliance requirements, and whether you want to manage infrastructure yourself or use a managed service. If you can tell me more about your setup, I can suggest a specific approach.
SECRETS VAULT SETUP ARCHITECTURE CHOOSE PROVIDER -> HashiCorp Vault (self-hosted): Complex but feature-rich; secrets rotation, dynamic creds, audit logging -> AWS Secrets Manager: Managed; pay per secret; auto-rotation via Lambda; IAM integration native -> Azure Key Vault: Good for Azure workloads; HSM option; access policies per secret -> Recommendation: Vault if multi-cloud or hybrid; Secrets Manager if AWS-only INITIAL SETUP (Vault example) 1. Deploy Vault server (high-availability mode with Consul backend) 2. Enable secret engines: KV v2 (versioning, soft delete), PKI (cert generation) 3. Configure auth methods: AppRole (service-to-service), JWT (CI/CD pipelines), LDAP (humans) 4. Set audit logging: File backend (JSON format, external syslog shipping) REST ROTATION POLICY -> Database credentials: Rotate every 30 days (automatic via Vault) -> API keys: Rotate every 90 days (manual policy enforcement) -> TLS certificates: Auto-renew 30 days before expiry -> Rotation trigger: Lambda (AWS) or Vault job engine ACCESS CONTROL MATRIX -> Developers: Read app secrets only (dev/ path) -> Services: Read their own credentials (auth/service-name) -> Database team: Manage database secrets (admin/database path) -> Audit: Read-only audit logs (no secret access) VERIFICATION CHECKLIST □ All secrets stored (no plaintext in code or .env) □ Rotation working: Check audit log for recent key changes □ Access logged: Each secret read logged with timestamp + user □ Encryption: Secrets encrypted at rest and in transit (TLS) □ Disaster recovery: Backup unsealing keys stored separately
About this skill
Moving a credential into a vault does not fix services that still use the old key, overly broad access, or rotation that only changes the stored value. This skill builds the complete path from workload identity to secret retrieval, safe credential replacement, and verified revocation.
What it does
- Chooses between HashiCorp Vault and cloud secret stores using your existing infrastructure and operational capacity.
- Produces scoped workload identities and policies, including Vault KV v2 paths and cloud encryption-key dependencies.
- Replaces hardcoded credentials with runtime retrieval, bounded caching, and explicit startup and outage behavior.
- Designs rotation around the credential issuer, application reloads, overlap periods, and old-credential revocation.
- Audits effective access, inherited permissions, deployment artifacts, and available access logs without exposing secret values.
- Separates proposed configuration, successful retrieval, application cutover, and completed revocation so unfinished migrations stay visible.
What you get
A request-sized implementation or audit with concrete configuration, application integration changes, a cutover sequence, and verification evidence. When execution access is unavailable, you get ready-to-adapt artifacts and clearly labeled checks that remain unperformed.
Best for
Engineers moving production credentials out of code or CI variables, teams introducing Vault or cloud secret stores, and operators investigating excessive access or unreliable rotation.
SKILL.md preview
---
name: secrets-vault-setup-rotation-and-access-audits
description: >-
Configure HashiCorp Vault or cloud secret stores, integrate workload authentication, and audit effective access using scoped policies, issuer-aware rotation, and explicit cutover checks. Use when the user says "set up Vault", "move our hardcoded keys into a secret manager", "configure AWS Secrets Manager", "connect our app to Azure Key Vault", "use GCP Secret Manager", "my services break whenever secrets rotate", or "who can read our production secrets?".
---
# Secrets Vault Setup, Rotation, and Access Audits
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.
LLM App and Agent Security Assessment
Threat-model an LLM app or agent: map injection paths, rate tool blast radius, and get architectural fixes plus canary tests.