---
title: "Configuration and secrets · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets
updated: 2026-10-20
licence: "All rights reserved"
---

# Configuration and secrets

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Keep settings in code and secrets in a store. Keep secrets out of state, let CI and services sign in with short-lived identity, and rotate on a timer.

Settings are values that may be public, such as a region or a pool size. Secrets are values that grant access, such as a database password. Code and state may hold settings, but never secrets. The app side is covered in [Keep settings outside the code](https://agentwranglers.se/playbook/engineering/running-in-production/settings-outside-the-code) and [Keep secrets in a secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store). Secrets in container images are covered in [Pass build secrets as mounts](https://agentwranglers.se/playbook/operations/containers/build-secrets).

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets`.

## Required

- [Create the secret's place in code and its value in the store](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/secret-containers-in-code): Create each secret's entry, owner and access policy in code. Put its value in the store by rotation or by hand, never through a code variable.
- [Keep secrets out of state](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/secrets-out-of-state): Pass secrets to resources in a way that never writes them into the state or plan files.
- [Let CI sign in with OIDC](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/oidc-for-ci): Let pipelines sign in to the cloud with a short-lived token from the CI provider's OIDC issuer. Store no cloud key in CI secrets.
- [Give services the identity of their machine](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/workload-identity): Let each running service get cloud credentials from the platform's identity, such as an instance role, a Kubernetes service account or a managed identity. Put no cloud key in its settings.

## Recommended

- [Rotate secrets automatically](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/automatic-secret-rotation): Let the secrets store rotate each secret on a schedule, every 90 days at most. The app picks up the new value without a deploy.

- Previous: [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)
- Next: [Networking and DNS](https://agentwranglers.se/playbook/infrastructure/networking-and-dns)
- [All chapters](https://agentwranglers.se/playbook/infrastructure)