Secrets Manager

Your application needs a credential, an API key, or a certificate, and you do
not want to put that value into your deployment configuration where anyone who
can read the config can read the secret. Secrets Manager is the self-service
SVIEW feature for creating and managing those values separately, then
referencing them from your application.

Where the values are stored

Secret values are never stored in SVIEW itself. They go into a cloud secret
store, and you choose which one when creating the secret:

Both of these are AWS services, so this choice applies to environments hosted
on AWS. The Secrets Manager panel in SVIEW works the same way whichever cloud
your environment runs on, but if your environment is on Google Cloud, raise a
request to confirm which store backs your secrets before assuming the options
above apply.

Creating a secret

1. Go to Secret Manager in the sidebar and click New.
2. Choose the Stage, Environment and Namespace the secret belongs to.
3. Decide who can use it:
   • For one application — leave Namespace-wide off and enter the
     Application name.
   • For every application in the namespace — turn Namespace-wide on.
     See Sharing a secret across a namespace.
4. Add a description and one or more key/value pairs. Turn on JSON format
   to store all the keys as one JSON secret instead of one secret per key.
5. Click Create.

Connecting the secret to your application

Creating a secret does not wire it into your application. Each application
that should receive it lists the keys it needs in its configuration:

1. Open the application Component and find the Secrets card. It lists the
   application's own secrets and any namespace-wide ones, which carry a
   global label.
2. Click Copy YAML snippet on the secret you need.
3. Open the Component's configuration and paste the snippet into the
   dependency block, matching the indentation of anything already there.
4. Remove any keys from ssmKeys that this application does not need.
5. Save. The Component redeploys with the keys available as environment
   variables.

For a namespace-wide secret on AWS, the copied snippet looks like this:

dependency:
    ssm:
        keys:
            - instance: global
              namespace: ._METADATA.NAMESPACE
              json: "false"
              namespaceWide: true
              sOverride: secretsmanager
              ssmKeys:
                - MY_KEY

The snippet is generated for your cloud, so paste it as copied rather than
editing it by hand. Use spaces, never tabs. Mismatched indentation breaks the
YAML, and this is the most common reason a pasted reference does not work.

Sharing a secret across a namespace

A namespace-wide secret is created once and can be used by every
application in that namespace — for example a shared API key or a common
database password. You do not create a copy per application, and the value is
changed in one place.

Each application still chooses which keys it receives: paste the snippet into
every Component that needs the secret, as described above. An application that
does not list a key does not get it.

Editing an existing secret

Click Edit on the secret, in the Component's Secrets card or in
Secret Manager, and change the keys directly. Changes save in place; there
is no need to recreate the secret.

Who can see and change secrets

• Creating, editing and deleting secrets needs Secret Manager writer access.
• Seeing the full value of a secret needs Secret Manager admin access.
• Anyone else can see that a secret exists, but not its value.

If you need a different level, raise a request.

Finding all your secrets

Secret Manager in the sidebar lists every secret across all your
applications in one place, so you do not have to open each application to find
one.

Related articles

• Inject Secrets from Parameter Store — the full ssm configuration reference, including how keys are exposed to your workload as environment variables
• Application Dependencies — all dependency engines
• Audit Logs
• Secret Not Found or Not Reaching Your Application — when a secret does not arrive