> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Securing Secrets using HashiCorp Vault
> This article discusses integrating HashiCorp Vault with GitHub Actions for centralized secret management and automation of secret synchronization.
Managing sensitive credentials across multiple repositories can be challenging. GitHub Actions stores secrets at the repository or environment level, but lacks versioning and centralized policy controls. By integrating HashiCorp Vault, you can maintain a single source of truth and automate secret synchronization across all your workflows.
## Why Centralize Secret Management?
GitHub Actions secrets are easy to configure but can become a maintenance burden as your organization scales:
| Storage Type | Versioning | Access Control | Maintenance Overhead |
| ----------------- | ---------- | ----------------------------------- | ---------------------- |
| GitHub Repository | No | Per-repo / per-environment policies | Duplicate in each repo |
| HashiCorp Vault | Yes | Fine-grained, dynamic ACLs & tokens | Centralized, auditable |
By standardizing on Vault, you gain:
* Automatic versioning and rotation
* Detailed audit logs
* Consistent policies across environments
## Defining a GitHub Actions Workflow
Create a workflow file under `.github/workflows/vault-demo.yaml` that manually triggers and checks for `AWS_API_KEY`:
```yaml theme={null}
name: Vault Demo
on:
workflow_dispatch:
jobs:
echo-vault-secret:
runs-on: ubuntu-latest
steps:
- name: Verify AWS_API_KEY exists
run: |
if [[ -z "${{ secrets.AWS_API_KEY }}" ]]; then
echo "::error::Secret Not Found"
exit 1
else
echo "::notice::Secret Found"
exit 0
fi
```
Ensure the workflow file is committed to the `main` branch (or your default branch) under `.github/workflows`.
When `AWS_API_KEY` is missing, the run fails:
```bash theme={null}
# Simulated check when AWS_API_KEY is unset
if [[ -z "" ]]; then
echo "Secret Not Found"
exit 1
fi
# Output:
Secret Not Found
```
## Provisioning HashiCorp Vault on HCP
HashiCorp Vault Secrets on the [HashiCorp Cloud Platform](https://cloud.hashicorp.com/) provides a fully managed service for centralized secret storage.
1. Sign in at the [HashiCorp Vault website](https://www.vaultproject.io/).
2. From the HCP dashboard, select **Vault Secrets**:
3. Click **Create application**, name it (e.g., **Secret App**), then add the `AWS_API_KEY` secret:
4. Use the **Add secret** button to insert your key/value pair:
New users may be eligible for free credits on HCP. Check the [pricing page](https://cloud.hashicorp.com/pricing) for details.
## Integrating Vault with GitHub Actions
Enable automatic synchronization so GitHub Actions can retrieve secrets directly from Vault:
1. In the Vault console, select **Integrations → GitHub Actions**:
2. Authorize access to your GitHub account and grant Vault permission to the target repository:
3. Configure the sync destination and save:
Integration at a glance:
| Step | Description |
| ----------------- | ----------------------------------------- |
| Authorize GitHub | Grant Vault read access to selected repos |
| Select Repository | Choose the repo containing your workflow |
| Configure Sync | Map Vault path to GitHub secret name |
| Save & Sync | Trigger initial secret import |
## Verifying the Workflow
After syncing, revisit **Settings → Secrets and variables → Actions** to confirm `AWS_API_KEY` appears alongside other repository secrets:
Re-run the **Vault Demo** workflow. The secret check now passes:
```bash theme={null}
# Masked secret check
if [[ -z "***" ]]; then
echo "Secret Not Found"
exit 1
else
echo "Secret Found"
exit 0
fi
# Output:
Secret Found
```
Always verify that only the minimum required permissions are granted when authorizing integrations. Avoid exposing secrets in plaintext logs.
## Links and References
* [HashiCorp Vault Documentation](https://www.vaultproject.io/docs)
* [GitHub Actions Secrets](https://docs.github.com/actions/security-guides/encrypted-secrets)
* [HashiCorp Cloud Platform](https://cloud.hashicorp.com/)
* [Vault Terraform Provider](https://registry.terraform.io/providers/hashicorp/vault/latest)