This documentation is available to agents as Markdown at https://docs.synthesized.io/tdk/latest/user_guide/070_integrations/secret_management.md. For the complete documentation index, see llms.txt.

Secret Management

Database passwords don’t have to live in configuration files or in Governor. The platform can read them from your secret manager each time it connects.

Your options

Where the credentials are How they’re protected

AWS Secrets Manager, Google Cloud Secret Manager or HashiCorp Vault

The platform keeps only a reference to the secret, and fetches the value when it connects. See Secret Managers.

Stored with the data source in Governor

Encrypted in Governor’s metadata database with AES and your 256-bit CREDENTIALS_ENCRYPTION_KEY. See Security Overview.

Given to the CLI as options or environment variables

As safe as the environment that holds them. In pipelines, take them from the CI system’s secret store.

Turn on a secret manager

Secret manager Setting

AWS Secrets Manager

SECRETS_AWS_SECRET_MANAGER_ENABLED=true

Google Cloud Secret Manager

SECRETS_GCP_SECRET_MANAGER_ENABLED=true

HashiCorp Vault

SECRETS_VAULT_SECRET_MANAGER_ENABLED=true, with the Vault connection properties

Set them on the CLI, or on Governor and its workers. See Application Properties.

Pages in this section

  • Secret Managers: the reference format for each secret manager, and where references go.

Related pages