Secrets Vault Manager
Stands up, configures, and audits secret management infrastructure so credentials never live in code, config files, or chat history.
Before & after
Same prompt, same agent — the only difference is the skill.
Setting up secret management is important for security and is definitely something you should do early. You have several options—HashiCorp Vault is a popular choice, and there are also managed cloud solutions like AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager. Each has different trade-offs around complexity, cost, and features. You'll want to think about secret rotation, audit logging, access control policies, and how secrets get injected into your applications. The right choice depends on your cloud provider, team size, compliance requirements, and whether you want to manage infrastructure yourself or use a managed service. If you can tell me more about your setup, I can suggest a specific approach.
SECRETS VAULT SETUP ARCHITECTURE CHOOSE PROVIDER -> HashiCorp Vault (self-hosted): Complex but feature-rich; secrets rotation, dynamic creds, audit logging -> AWS Secrets Manager: Managed; pay per secret; auto-rotation via Lambda; IAM integration native -> Azure Key Vault: Good for Azure workloads; HSM option; access policies per secret -> Recommendation: Vault if multi-cloud or hybrid; Secrets Manager if AWS-only INITIAL SETUP (Vault example) 1. Deploy Vault server (high-availability mode with Consul backend) 2. Enable secret engines: KV v2 (versioning, soft delete), PKI (cert generation) 3. Configure auth methods: AppRole (service-to-service), JWT (CI/CD pipelines), LDAP (humans) 4. Set audit logging: File backend (JSON format, external syslog shipping) REST ROTATION POLICY -> Database credentials: Rotate every 30 days (automatic via Vault) -> API keys: Rotate every 90 days (manual policy enforcement) -> TLS certificates: Auto-renew 30 days before expiry -> Rotation trigger: Lambda (AWS) or Vault job engine ACCESS CONTROL MATRIX -> Developers: Read app secrets only (dev/ path) -> Services: Read their own credentials (auth/service-name) -> Database team: Manage database secrets (admin/database path) -> Audit: Read-only audit logs (no secret access) VERIFICATION CHECKLIST □ All secrets stored (no plaintext in code or .env) □ Rotation working: Check audit log for recent key changes □ Access logged: Each secret read logged with timestamp + user □ Encryption: Secrets encrypted at rest and in transit (TLS) □ Disaster recovery: Backup unsealing keys stored separately
About this skill
name: secrets-vault-manager description: Use when Use when the user asks to set up secret management infrastructure, integrate HashiCorp Vault, configure cloud secret stores (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), implement sec...
Secrets Vault Manager
Use when the user asks to set up secret management infrastructure, integrate HashiCorp Vault, configure cloud secret stores (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), implement secret rotation, or audit secret access patterns.
What you get
- Public GitHub repo (alirezarezvani/claude-skills)
- the secrets-vault-manager skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.
Customize your output
- Fork the repo and adapt the skill's instructions and references to your workflow.
Example output
Activates automatically when your request matches Secrets Vault Manager; chains with the other skills, agents, and commands in the collection.
Best for
Creators, builders, and teams using Claude Code.
SKILL.md preview
---
name: secrets-vault-manager
description: Use when the user asks to set up secret management infrastructure, integrate HashiCorp Vault, configure cloud secret stores, implement secret rotation, or audit secret access patterns.
version: 1.0.0
category: Development / Engineering
author: AgentVolt
license: proprietary
tags:
- development
- engineering
---
# Secrets Vault Manager
Stands up, configures, and audits secret management infrastructure so credentials never live in code, config files, or chat history.
## When to use
… (sign up to view the full skill)More development skills
View all Development skills →Generate
Scaffold code, tests, and boilerplate from a short spec.
Performance Profiler
Systematic performance profiling for Node.js, Python, and Go applications.
Threat Detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.
Agent Harness
Turns a domain folder of skills into a bounded agentic loop: compile a goal into a task plan, execute with the domain's tools, verify every task, retry within a budget.