Configuration and secrets

Settings are values that may be public, such as a region or a pool size. Secrets are values that grant access, such as a database password. Code and state may hold settings, but never secrets. The app side is covered in Keep settings outside the code and Keep secrets in a secrets store. Secrets in container images are covered in Pass build secrets as mounts.

Required

• Create the secret's place in code and its value in the store

  Required

  Create each secret's entry, owner and access policy in code. Put its value in the store by rotation or by hand, never through a code variable.

• Keep secrets out of state

  Required

  Pass secrets to resources in a way that never writes them into the state or plan files.

• Let CI sign in with OIDC

  Required

  Let pipelines sign in to the cloud with a short-lived token from the CI provider's OIDC issuer. Store no cloud key in CI secrets.

• Give services the identity of their machine

  Required

  Let each running service get cloud credentials from the platform's identity, such as an instance role, a Kubernetes service account or a managed identity. Put no cloud key in its settings.

Recommended

• Rotate secrets automatically

  Recommended

  Let the secrets store rotate each secret on a schedule, every 90 days at most. The app picks up the new value without a deploy.