Agent skill · security · alirezarezvani
secrets-vault-manager
Use when setting up HashiCorp Vault, AWS Secrets Manager, Azure Key Vault or GCP Secret Manager, rotating secrets or auditing secret access. Generates config with vault_config_generator.py, plans rotation with rotation_planner.py and analyzes audit logs.
Why this skill is useful
Adds detailed implementation patterns and scripts for integrating and managing secret management infrastructure that the AI cannot generate on its own.
What it needs
Requires hashicorp-vault installed locally. Requires aws, azure, gcp account access. About 8k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
Secrets Vault Manager Tier: POWERFUL Category: Engineering Domain: Security / Infrastructure / DevOps --- Overview Production secret infrastructure management for teams running HashiCorp Vault, cloud-native secret stores, or hybrid architectures. This skill covers policy authoring, auth method configuration, automated rotation, dynamic secrets, audit logging, and incident response. Distinct from env-secrets-manager which handles local .env file hygiene and leak detection. This skill operates at the infrastructure layer — Vault clusters, cloud KMS, certificate authorities, and CI/CD secret injection. When to Use Standing up a new Vault cluster or migrating to a managed secret store Designing auth methods for services, CI runners, and human operators Implementing automated credential rotation (database, API keys, certificates) Auditing secret access patterns for compliance (SOC 2, ISO 27001, HIPAA) Responding to a secret leak that requires mass revocation Integrating secrets into Kubernetes workloads or CI/CD pipelines --- HashiCorp Vault Patterns Architecture Decisions Decision Recommendation Rationale ---------- --------------- ----------- Deployment mode HA with Raft storage No external dependency, built-in leader election Auto-unseal Cloud KMS (AWS KMS / Azure Key Vault / GCP KMS) Eliminates manual unseal, enables automated restarts Namespaces One per environment (dev/staging/prod) Blast-radius isolation, independent policies Audit devices File + syslog (dual) Vault refuses requests if all audit devices fail — dual prevents outages Auth Methods AppRole — Machine-to-machine authentication for services and batch jobs. Kubernetes — Pod-native authentication via service account tokens. OIDC — Human operator access via SSO provider (Okta, Azure AD, Google Workspace). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/secrets-vault-manager--9ee636