/users/security/Recent content in Security Services on DocumentationHugo -- gohugo.io/users/security/secrets-store/Mon, 01 Jan 0001 00:00:00 +0000/users/security/secrets-store/ <h2 id="what-is-it">What is it?</h2> <p>Your applications and services may need different secrets (credentials, tokens, passwords, etc.) during deployment and operation. These secrets are often stored as clear texts in code repositories or configuration files, which poses security risks. Furthermore, the secrets stored in files are static and difficult to change (rotate).</p> <p>The EGI Secrets Store helps you to <strong>securely store, retrieve, and rotate credentials for your services</strong>.</p> <p>The main features of EGI Secrets Store:</p> <ul> <li>Simplifies, standardizes, and secures the way users store secrets.</li> <li>Offers secure storage of secrets, encrypted both in transit and at rest.</li> <li>Allows easy rotation of secrets, while administrators can track usage and manage access.</li> <li>Integrates with <a href="../../aai/check-in/">EGI Check-in</a> to allow access with home organisation credentials, no additional registration needed.</li> <li>High-availability ensures the service is always accessible to users, applications and other services that rely of it.</li> <li>Easy to maintain, upgrade, and extend, as it is based on well-known open-source software, with many client tools and libraries with strong community support.</li> </ul> <h2 id="concepts">Concepts</h2> <p><strong>Secret objects</strong> (or secrets, for short) in EGI Secrets Store are identified by their paths, like files on disk. Each user has a private <strong>secret space</strong> for storing their secret objects, and cannot see secrets of other users. Each secret object may contain several <strong>secret values</strong>, and each value is identified by its <strong>key</strong> (name).</p> <div class="alert alert-info" role="alert"> <h4 class="alert-heading">Example</h4> A secret object for your service may contain several different passwords for different components: database, message queue, cache, storage system, etc. Each of these passwords will be a distinct secret value in your secret object. </div> <p>Secret objects are always created, retrieved, updated, and deleted as a whole, users cannot manipulate individual secret values of an existing secret.</p>