Secrets Manager

Your application needs a credential, an API key, or a certificate, and you do
not want to put that value into your deployment configuration where anyone who
can read the config can read the secret. Secrets Manager is the self-service
SVIEW feature for creating and managing those values separately, then
referencing them from your application.

Where the values are stored

Secret values are never stored in SVIEW itself. They go into a cloud secret
store, and you choose which one when creating the secret:

Both of these are AWS services, so this choice applies to environments hosted
on AWS. The Secrets Manager panel in SVIEW works the same way whichever cloud
your environment runs on, but if your environment is on Google Cloud, raise a
request to confirm which store backs your secrets before assuming the options
above apply.

Creating a secret

1. Open your application Component's configuration.
2. Go to the Secrets panel.
3. Add a name, a description, and one or more key/value pairs.
4. Click Create.

SVIEW creates the secret in the store you selected and generates a reference
for it.

Connecting the secret to your application

Creating a secret does not wire it into your application. You add the
generated reference to the application's configuration yourself:

1. Copy the reference shown when you created the secret, or when viewing it
   later.
2. Open your application's configuration.
3. Paste the reference into the ssm dependency block — SSM keys in the
   SVIEW editor — matching the indentation of any keys already there.
4. Save.

Use spaces, never tabs. Mismatched indentation breaks the YAML, and this is the
most common reason a pasted reference does not work.

Editing an existing secret

Open the Secrets panel for the application and edit the keys directly.
Changes save in place; there is no need to recreate the secret.

Finding all your secrets

The Secrets Manager section in the left sidebar lists every secret across
all of your applications in one place, so you do not have to open each
application to find one.

Scope

Secrets are created per application. To use the same values in more than one
application, create the secret separately in each.

Related articles

• Application Dependencies
  — the full ssm configuration reference, including how keys are exposed to
  your workload as environment variables
• Audit Logs