Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Used when handling sensitive credentials, rotating secrets, or protecting CI/CD environments.
English | 日本語
Vault、AWS Secrets Manager、その他のツールを使用したCI/CDパイプライン用の安全なシークレット管理プラクティス。
機密情報をハードコーディングせずにCI/CDパイプラインで安全なシークレット管理を実装する。
# Vault開発サーバーを起動
vault server -dev
# 環境を設定
export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='root'
# シークレットエンジンを有効化
vault secrets enable -path=secret kv-v2
# シークレットを保存
vault kv put secret/database/config username=admin password=secret
name: Deploy with Vault Secrets
on: [push]
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Import Secrets from Vault
uses: hashicorp/vault-action@v2
with:
url: https://vault.example.com:8200
token: ${{ secrets.VAULT_TOKEN }}
secrets: |
secret/data/database username | DB_USERNAME ;
secret/data/database password | DB_PASSWORD ;
secret/data/api key | API_KEY
- name: Use secrets
run: |
echo "データベースに$DB_USERNAMEとして接続"
# $DB_PASSWORD、$API_KEYを使用
deploy:
image: vault:latest
before_script:
- export VAULT_ADDR=https://vault.example.com:8200
- export VAULT_TOKEN=$VAULT_TOKEN
- apk add curl jq
script:
- |
DB_PASSWORD=$(vault kv get -field=password secret/database/config)
API_KEY=$(vault kv get -field=key secret/api/credentials)
echo "シークレットでデプロイ中..."
# $DB_PASSWORD、$API_KEYを使用
参照: references/vault-setup.mdを参照
aws secretsmanager create-secret \
--name production/database/password \
--secret-string "super-secret-password"
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-west-2
- name: Get secret from AWS
run: |
SECRET=$(aws secretsmanager get-secret-value \
--secret-id production/database/password \
--query SecretString \
--output text)
echo "::add-mask::$SECRET"
echo "DB_PASSWORD=$SECRET" >> $GITHUB_ENV
- name: Use secret
run: |
# $DB_PASSWORDを使用
./deploy.sh
data "aws_secretsmanager_secret_version" "db_password" {
secret_id = "production/database/password"
}
resource "aws_db_instance" "main" {
allocated_storage = 100
engine = "postgres"
instance_class = "db.t3.large"
username = "admin"
password = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)["password"]
}
- name: Use GitHub secret
run: |
echo "API Key: ${{ secrets.API_KEY }}"
echo "Database URL: ${{ secrets.DATABASE_URL }}"
deploy:
runs-on: ubuntu-latest
environment: production
steps:
- name: Deploy
run: |
echo "${{ secrets.PROD_API_KEY }}でデプロイ中"
参照: references/github-secrets.mdを参照
deploy:
script:
- echo "$API_KEYでデプロイ中"
- echo "Database: $DATABASE_URL"
import boto3
import json
def lambda_handler(event, context):
client = boto3.client('secretsmanager')
# 現在のシークレットを取得
response = client.get_secret_value(SecretId='my-secret')
current_secret = json.loads(response['SecretString'])
# 新しいパスワードを生成
new_password = generate_strong_password()
# データベースパスワードを更新
update_database_password(new_password)
# シークレットを更新
client.put_secret_value(
SecretId='my-secret',
SecretString=json.dumps({
'username': current_secret['username'],
'password': new_password
})
)
return {'statusCode': 200}
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
name: vault-backend
namespace: production
spec:
provider:
vault:
server: "https://vault.example.com:8200"
path: "secret"
version: "v2"
auth:
kubernetes:
mountPath: "kubernetes"
role: "production"
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: database-credentials
namespace: production
spec:
refreshInterval: 1h
secretStoreRef:
name: vault-backend
kind: SecretStore
target:
name: database-credentials
creationPolicy: Owner
data:
- secretKey: username
remoteRef:
key: database/config
property: username
- secretKey: password
remoteRef:
key: database/config
property: password
#!/bin/bash
# .git/hooks/pre-commit
# TruffleHogでシークレットをチェック
docker run --rm -v "$(pwd):/repo" \
trufflesecurity/trufflehog:latest \
filesystem --directory=/repo
if [ $? -ne 0 ]; then
echo "❌ シークレットが検出されました！コミットがブロックされました。"
exit 1
fi
secret-scan:
stage: security
image: trufflesecurity/trufflehog:latest
script:
- trufflehog filesystem .
allow_failure: false
references/vault-setup.md - HashiCorp Vault設定references/github-secrets.md - GitHubシークレットベストプラクティスgithub-actions-templates - GitHub Actions統合用gitlab-ci-patterns - GitLab CI統合用deployment-pipeline-design - パイプラインアーキテクチャ用Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer