Secrets Vault Manager

Secrets Vault Manager

> Category: Engineering

> Domain: Secrets Management & Security

Overview

The Secrets Vault Manager skill provides tools for generating HashiCorp Vault configurations, planning and scheduling secret rotation cycles, and analyzing vault audit logs for suspicious access patterns. Essential for teams managing secrets at scale.

Clarify First

Before generating configs or plans, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• [ ] Task — config generation / rotation planning / audit-log analysis (selects the script and the entire workflow)
• [ ] Environment & secrets engines — e.g. production + kv/database/transit (--env, --secrets-engines; shapes the generated HCL)
• [ ] Secrets inventory & classification — Critical/High/Medium/Low per secret (drives rotation frequencies and the schedule)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Quick Start

# Generate Vault configuration
python scripts/vault_config_generator.py --env production --secrets-engines kv,database,transit

# Plan secret rotation schedule
python scripts/rotation_planner.py --inventory secrets_inventory.json

# Analyze vault audit logs
python scripts/audit_log_analyzer.py --log-file vault_audit.log --format json

Tools Overview

| Tool | Purpose | Key Flags |

|------|---------|-----------|

| vault_config_generator.py | Generate HashiCorp Vault configurations | --env, --secrets-engines, --auth-methods |

| rotation_planner.py | Plan and schedule secret rotation cycles | --inventory, --policy, --format |

| audit_log_analyzer.py | Analyze vault audit logs for anomalies | --log-file, --time-range, --format |

Workflows

Initial Vault Setup

• Define environment and required secrets engines
• Run vault_config_generator.py to generate HCL configs
• Review and customize generated configurations
• Apply via Terraform or Vault CLI

Secret Rotation Planning

• Create secrets inventory (JSON)
• Run rotation_planner.py to generate schedule
• Review rotation plan and adjust frequencies
• Implement automated rotation where possible

Audit Log Investigation

• Export vault audit logs
• Run audit_log_analyzer.py for anomaly detection
• Review flagged events
• Investigate suspicious access patterns

Reference Documentation

• Secrets Management Guide - Best practices, rotation policies, and compliance requirements

Common Patterns

Secret Classification

• Critical: Database credentials, API master keys, encryption keys
• High: Service account tokens, OAuth secrets, TLS certificates
• Medium: Third-party API keys, webhook secrets
• Low: Public API keys, non-sensitive configuration