Securing Secrets using HashiCorp Vault

​

Why Centralized Secrets Matter

​

1. Reviewing GitHub Repository Secrets

​

2. Setting Up a Simple Vault‐Demo Workflow

name: Vault Demo
on:
  workflow_dispatch:
jobs:
  echo-vault-secret:
    runs-on: ubuntu-latest
    steps:
      - name: Check for AWS_API_KEY
        run: |
          if [[ -z "${{ secrets.AWS_API_KEY }}" ]]; then
            echo "Secret Not Found" && exit 1
          else
            echo "Secret Found" && exit 0
          fi

Run if [[ -z "${{ secrets.AWS_API_KEY }}" ]]; then ...
Secret Not Found
Error: Process completed with exit code 1.

​

3. Storing a Secret in HashiCorp Vault

1. Sign in to the HashiCorp Cloud Platform and select Vault:

2. In the HCP dashboard, click Vault Secrets to open the managed secrets service:

3. Create an application (e.g., Secret App), then add a key AWS_API_KEY with your value:

​

4. Integrating Vault Secrets with GitHub Actions

1. In the Vault UI, go to Integrations → GitHub Actions, then authorize the GitHub App on your organization or account:

2. Select the repo(s) to sync and install:

3. After installation, Vault Secrets pushes AWS_API_KEY to your repo. Refresh Settings → Secrets and variables → Actions:

​

5. Verifying the Pipeline

Run if [[ -z "***" ]]; then ...
Secret Found

​

Further Reading & References

• HashiCorp Vault Documentation
• GitHub Actions Secrets
• HCP Vault Secrets Overview
• Terraform Registry: vault Provider