Securing Secrets using HashiCorp Vault

​

Why Centralize Secret Management?

• Automatic versioning and rotation
• Detailed audit logs
• Consistent policies across environments

​

Defining a GitHub Actions Workflow

name: Vault Demo
on:
  workflow_dispatch:

jobs:
  echo-vault-secret:
    runs-on: ubuntu-latest
    steps:
      - name: Verify AWS_API_KEY exists
        run: |
          if [[ -z "${{ secrets.AWS_API_KEY }}" ]]; then
            echo "::error::Secret Not Found"
            exit 1
          else
            echo "::notice::Secret Found"
            exit 0
          fi

# Simulated check when AWS_API_KEY is unset
if [[ -z "" ]]; then
  echo "Secret Not Found"
  exit 1
fi

# Output:
Secret Not Found

​

Provisioning HashiCorp Vault on HCP

1. Sign in at the HashiCorp Vault website.

2. From the HCP dashboard, select Vault Secrets:

3. Click Create application, name it (e.g., Secret App), then add the AWS_API_KEY secret:

4. Use the Add secret button to insert your key/value pair:

​

Integrating Vault with GitHub Actions

1. In the Vault console, select Integrations → GitHub Actions:

2. Authorize access to your GitHub account and grant Vault permission to the target repository:

3. Configure the sync destination and save:

​

Verifying the Workflow

# Masked secret check
if [[ -z "***" ]]; then
  echo "Secret Not Found"
  exit 1
else
  echo "Secret Found"
  exit 0
fi

# Output:
Secret Found

​

Links and References

• HashiCorp Vault Documentation
• GitHub Actions Secrets
• HashiCorp Cloud Platform
• Vault Terraform Provider