Securing Secrets using HashiCorp Vault

Managing sensitive credentials across multiple repositories can be challenging. GitHub Actions stores secrets at the repository or environment level, but lacks versioning and centralized policy controls. By integrating HashiCorp Vault, you can maintain a single source of truth and automate secret synchronization across all your workflows.

Why Centralize Secret Management?

GitHub Actions secrets are easy to configure but can become a maintenance burden as your organization scales:

By standardizing on Vault, you gain:

• Automatic versioning and rotation
• Detailed audit logs
• Consistent policies across environments

Defining a GitHub Actions Workflow

Create a workflow file under .github/workflows/vault-demo.yaml that manually triggers and checks for AWS_API_KEY:

name: Vault Demo
on:
  workflow_dispatch:

jobs:
  echo-vault-secret:
    runs-on: ubuntu-latest
    steps:
      - name: Verify AWS_API_KEY exists
        run: |
          if [[ -z "${{ secrets.AWS_API_KEY }}" ]]; then
            echo "::error::Secret Not Found"
            exit 1
          else
            echo "::notice::Secret Found"
            exit 0
          fi

When AWS_API_KEY is missing, the run fails:

# Simulated check when AWS_API_KEY is unset
if [[ -z "" ]]; then
  echo "Secret Not Found"
  exit 1
fi

# Output:
Secret Not Found

Provisioning HashiCorp Vault on HCP

HashiCorp Vault Secrets on the HashiCorp Cloud Platform provides a fully managed service for centralized secret storage.

1. Sign in at the HashiCorp Vault website.

   

2. From the HCP dashboard, select Vault Secrets:

   

3. Click Create application, name it (e.g., Secret App), then add the AWS_API_KEY secret:

   

4. Use the Add secret button to insert your key/value pair:

   

Integrating Vault with GitHub Actions

Enable automatic synchronization so GitHub Actions can retrieve secrets directly from Vault:

1. In the Vault console, select Integrations → GitHub Actions:

   

2. Authorize access to your GitHub account and grant Vault permission to the target repository:

   

3. Configure the sync destination and save:

   

Integration at a glance:

Verifying the Workflow

After syncing, revisit Settings → Secrets and variables → Actions to confirm AWS_API_KEY appears alongside other repository secrets:

Re-run the Vault Demo workflow. The secret check now passes:

# Masked secret check
if [[ -z "***" ]]; then
  echo "Secret Not Found"
  exit 1
else
  echo "Secret Found"
  exit 0
fi

# Output:
Secret Found

Links and References

• HashiCorp Vault Documentation
• GitHub Actions Secrets
• HashiCorp Cloud Platform
• Vault Terraform Provider