> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Securing Secrets using HashiCorp Vault
> This article explains how to integrate HashiCorp Vault with GitHub Actions for centralized and secure secret management in CI/CD pipelines.
Managing secrets across multiple repositories can be error‐prone, inconsistent, and difficult to audit. By integrating HashiCorp Vault with GitHub Actions, you can centralize secret storage, enforce versioning, and keep your CI/CD pipelines secure.
***
## Why Centralized Secrets Matter
GitHub supports two secret scopes:
| Scope | Versioning | Management Overhead | Best Use Case |
| ------------------- | ---------- | ------------------- | ------------------------------ |
| Repository-level | No | High (per repo) | Single-repo deployments |
| Environment-level | No | High (per env) | Environment-specific workflows |
| Vault Secrets (HCP) | Yes | Low (centralized) | Multi-repo CI/CD pipelines |
***
## 1. Reviewing GitHub Repository Secrets
Most teams start by defining secrets directly in GitHub. You’ll find them at **Settings → Secrets and variables → Actions**.
Repository-level secrets are not versioned. Managing them individually across many repos can quickly become tedious and error-prone.
***
## 2. Setting Up a Simple Vault‐Demo Workflow
Create a workflow file at `.github/workflows/vault-demo.yml`:
```yaml theme={null}
name: Vault Demo
on:
workflow_dispatch:
jobs:
echo-vault-secret:
runs-on: ubuntu-latest
steps:
- name: Check for AWS_API_KEY
run: |
if [[ -z "${{ secrets.AWS_API_KEY }}" ]]; then
echo "Secret Not Found" && exit 1
else
echo "Secret Found" && exit 0
fi
```
Running this before adding the secret returns:
```bash theme={null}
Run if [[ -z "${{ secrets.AWS_API_KEY }}" ]]; then ...
Secret Not Found
Error: Process completed with exit code 1.
```
***
## 3. Storing a Secret in HashiCorp Vault
1. Sign in to the [HashiCorp Cloud Platform](https://cloud.hashicorp.com) and select **Vault**:
2. In the HCP dashboard, click **Vault Secrets** to open the managed secrets service:
3. Create an application (e.g., **Secret App**), then add a key `AWS_API_KEY` with your value:
***
## 4. Integrating Vault Secrets with GitHub Actions
1. In the Vault UI, go to **Integrations → GitHub Actions**, then authorize the GitHub App on your organization or account:
2. Select the repo(s) to sync and install:
3. After installation, Vault Secrets pushes `AWS_API_KEY` to your repo. Refresh **Settings → Secrets and variables → Actions**:
***
## 5. Verifying the Pipeline
If you ran the workflow before syncing, you might still see a failed status. Rerun to pick up the new secret.
Once synced, triggering **Vault Demo** again outputs:
```bash theme={null}
Run if [[ -z "***" ]]; then ...
Secret Found
```
***
## Further Reading & References
* [HashiCorp Vault Documentation](https://www.vaultproject.io/docs)
* [GitHub Actions Secrets](https://docs.github.com/actions/security-guides/encrypted-secrets)
* [HCP Vault Secrets Overview](https://cloud.hashicorp.com/products/vault/secrets-management)
* [Terraform Registry: vault Provider](https://registry.terraform.io/providers/hashicorp/vault/latest)
With this setup, your CI/CD pipelines gain centralized, versioned secret management—eliminating duplicated credentials and securing your workflows end‐to‐end.