1# Start Vault dev server
 2vault server -dev
 3
 4# Set environment
 5export VAULT_ADDR='http://127.0.0.1:8200'
 6export VAULT_TOKEN='root'
 7
 8# Enable secrets engine
 9vault secrets enable -path=secret kv-v2
10
11# Store secret
12vault kv put secret/database/config username=admin password=secret

 1name: Deploy with Vault Secrets
 2
 3on: [push]
 4
 5jobs:
 6  deploy:
 7    runs-on: ubuntu-latest
 8    steps:
 9      - uses: actions/checkout@v4
10
11      - name: Import Secrets from Vault
12        uses: hashicorp/vault-action@v2
13        with:
14          url: https://vault.example.com:8200
15          token: ${{ secrets.VAULT_TOKEN }}
16          secrets: |
17            secret/data/database username | DB_USERNAME ;
18            secret/data/database password | DB_PASSWORD ;
19            secret/data/api key | API_KEY
20
21      - name: Use secrets
22        run: |
23          echo "Connecting to database as $DB_USERNAME"
24          # Use $DB_PASSWORD, $API_KEY

 1deploy:
 2  image: vault:latest
 3  before_script:
 4    - export VAULT_ADDR=https://vault.example.com:8200
 5    - export VAULT_TOKEN=$VAULT_TOKEN
 6    - apk add curl jq
 7  script:
 8    - |
 9      DB_PASSWORD=$(vault kv get -field=password secret/database/config)
10      API_KEY=$(vault kv get -field=key secret/api/credentials)
11      echo "Deploying with secrets..."
12      # Use $DB_PASSWORD, $API_KEY

1aws secretsmanager create-secret \
2  --name production/database/password \
3  --secret-string "super-secret-password"

 1- name: Configure AWS credentials
 2  uses: aws-actions/configure-aws-credentials@v4
 3  with:
 4    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
 5    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 6    aws-region: us-west-2
 7
 8- name: Get secret from AWS
 9  run: |
10    SECRET=$(aws secretsmanager get-secret-value \
11      --secret-id production/database/password \
12      --query SecretString \
13      --output text)
14    echo "::add-mask::$SECRET"
15    echo "DB_PASSWORD=$SECRET" >> $GITHUB_ENV
16
17- name: Use secret
18  run: |
19    # Use $DB_PASSWORD
20    ./deploy.sh

 1data "aws_secretsmanager_secret_version" "db_password" {
 2  secret_id = "production/database/password"
 3}
 4
 5resource "aws_db_instance" "main" {
 6  allocated_storage    = 100
 7  engine              = "postgres"
 8  instance_class      = "db.t3.large"
 9  username            = "admin"
10  password            = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)["password"]
11}

1- name: Use GitHub secret
2  run: |
3    echo "API Key: ${{ secrets.API_KEY }}"
4    echo "Database URL: ${{ secrets.DATABASE_URL }}"

1deploy:
2  runs-on: ubuntu-latest
3  environment: production
4  steps:
5    - name: Deploy
6      run: |
7        echo "Deploying with ${{ secrets.PROD_API_KEY }}"

1deploy:
2  script:
3    - echo "Deploying with $API_KEY"
4    - echo "Database: $DATABASE_URL"

 1import boto3
 2import json
 3
 4def lambda_handler(event, context):
 5    client = boto3.client('secretsmanager')
 6
 7    # Get current secret
 8    response = client.get_secret_value(SecretId='my-secret')
 9    current_secret = json.loads(response['SecretString'])
10
11    # Generate new password
12    new_password = generate_strong_password()
13
14    # Update database password
15    update_database_password(new_password)
16
17    # Update secret
18    client.put_secret_value(
19        SecretId='my-secret',
20        SecretString=json.dumps({
21            'username': current_secret['username'],
22            'password': new_password
23        })
24    )
25
26    return {'statusCode': 200}

 1apiVersion: external-secrets.io/v1beta1
 2kind: SecretStore
 3metadata:
 4  name: vault-backend
 5  namespace: production
 6spec:
 7  provider:
 8    vault:
 9      server: "https://vault.example.com:8200"
10      path: "secret"
11      version: "v2"
12      auth:
13        kubernetes:
14          mountPath: "kubernetes"
15          role: "production"
16
17---
18apiVersion: external-secrets.io/v1beta1
19kind: ExternalSecret
20metadata:
21  name: database-credentials
22  namespace: production
23spec:
24  refreshInterval: 1h
25  secretStoreRef:
26    name: vault-backend
27    kind: SecretStore
28  target:
29    name: database-credentials
30    creationPolicy: Owner
31  data:
32    - secretKey: username
33      remoteRef:
34        key: database/config
35        property: username
36    - secretKey: password
37      remoteRef:
38        key: database/config
39        property: password

 1#!/bin/bash
 2# .git/hooks/pre-commit
 3
 4# Check for secrets with TruffleHog
 5docker run --rm -v "$(pwd):/repo" \
 6  trufflesecurity/trufflehog:latest \
 7  filesystem --directory=/repo
 8
 9if [ $? -ne 0 ]; then
10  echo "❌ Secret detected! Commit blocked."
11  exit 1
12fi

1secret-scan:
2  stage: security
3  image: trufflesecurity/trufflehog:latest
4  script:
5    - trufflehog filesystem .
6  allow_failure: false