From skillry-cloud-and-infrastructure
Use when you need to review or design secret and configuration handling — secret managers (Vault, AWS Secrets Manager, SSM, GCP/Azure), rotation, runtime injection, keeping secrets out of IaC and images, sealed/external secrets, and config-vs-secret separation.
How this skill is triggered — by the user, by Claude, or both
Slash command
/skillry-cloud-and-infrastructure:335-secrets-and-config-managementThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Review and design how an application and its infrastructure handle secrets and configuration — selecting a secret manager (Vault, AWS Secrets Manager, SSM Parameter Store, GCP Secret Manager, Azure Key Vault), defining rotation, injecting secrets at runtime rather than baking them into images or IaC, separating non-sensitive config from secrets, and using sealed/external secrets in Kubernetes. ...
Review and design how an application and its infrastructure handle secrets and configuration — selecting a secret manager (Vault, AWS Secrets Manager, SSM Parameter Store, GCP Secret Manager, Azure Key Vault), defining rotation, injecting secrets at runtime rather than baking them into images or IaC, separating non-sensitive config from secrets, and using sealed/external secrets in Kubernetes. The goal is that no secret ever lives in source, IaC state, container layers, or logs, that every secret is rotatable, and that access is least-privilege and audited. Ground findings in the repo's actual files and manifests.
.env, IaC, container images, or CI logs.Secret vs sealed/external secrets).# High-signal patterns across the tree (exclude vendored/build dirs)
grep -rniE "(api[_-]?key|secret|password|token|passwd|private[_-]?key|client[_-]?secret)\s*[:=]\s*['\"][^'\"$]{6,}" \
. --include="*.*" 2>/dev/null | grep -vE "example|sample|test|\.lock|node_modules" | head -40
# Provider key shapes (AWS access key id, private key blocks)
grep -rnE "AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY-----" . 2>/dev/null | head
# Dedicated scanners if available
gitleaks detect --no-banner 2>/dev/null || trufflehog filesystem . 2>/dev/null | tail -20
git ls-files | grep -E "\.env$|\.env\.|secrets?\.(ya?ml|json)|\.pem$|credentials$" && echo "TRACKED SECRET FILES — CRITICAL"
grep -E "\.env|secrets|\.pem|credentials" .gitignore 2>/dev/null || echo "secret files not gitignored"
# Which secret backend is referenced?
grep -rniE "secretsmanager|ssm|parameter store|vault|key.?vault|secret.?manager|sealed.?secret|external.?secret" . --include="*.tf" --include="*.yaml" --include="*.y*ml" | head
# How does the app read config/secrets at runtime?
grep -rnE "os\.environ|process\.env|getenv|System\.getenv|Environment\.GetEnvironmentVariable" . 2>/dev/null | head
# Plaintext secret values in IaC / vars
grep -rnE "(password|secret|token|key)\s*=\s*\"[^\"$]" . --include="*.tf" --include="*.tfvars" | grep -v "secretsmanager\|ssm\|vault\|data\." | head
# Secrets baked into Docker layers
grep -rnE "ARG .*(SECRET|TOKEN|PASSWORD|KEY)|ENV .*(SECRET|TOKEN|PASSWORD)|COPY .*(\.env|\.pem|credentials)" . --include="Dockerfile*"
# Plaintext Secret manifests vs sealed/external secrets
grep -rn "kind: Secret" -A4 . --include="*.yaml" | grep -i "stringData\|data:"
grep -rln "kind: SealedSecret\|kind: ExternalSecret\|kind: SecretStore" . --include="*.yaml"
# Rotation hooks (Secrets Manager rotation lambda, Vault TTL/lease, dynamic secrets)
grep -rniE "rotation|rotate|lease|ttl|max_ttl" . --include="*.tf" --include="*.hcl" | head
# Non-secret config should live separately from secrets (configmaps / settings vs secret refs)
grep -rln "kind: ConfigMap" . --include="*.yaml"
.tfvars, manifests, Dockerfiles, or committed .env files..env, *.pem, credentials, and secret YAML/JSON are gitignored and absent from git history.Secrets.# Terraform: reference a secret, never store its value
data "aws_secretsmanager_secret_version" "db" {
secret_id = "prod/db/password" # value lives in Secrets Manager
}
resource "aws_db_instance" "primary" {
username = "app"
password = data.aws_secretsmanager_secret_version.db.secret_string # not hardcoded
}
# Scoped read policy — least privilege to ONE secret
data "aws_iam_policy_document" "read_db_secret" {
statement {
actions = ["secretsmanager:GetSecretValue"]
resources = [aws_secretsmanager_secret.db.arn] # not "*"
}
}
# Kubernetes: ExternalSecret pulls from the manager into a native Secret at runtime
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata: { name: api-secrets, namespace: prod }
spec:
refreshInterval: 1h
secretStoreRef: { name: aws-secrets, kind: SecretStore }
target: { name: api-secrets }
data:
- secretKey: DB_PASSWORD
remoteRef: { key: prod/db/password }
# Safe detection only — never print the secret value
gitleaks detect --no-banner --redact # redacts matches in output
aws secretsmanager describe-secret --secret-id prod/db/password # metadata, not value
.env, config.json, or .tfvars — and still present in git history after "removal".*.tf file or a Kubernetes Secret manifest (base64 is not encryption).ARG/ENV — permanently embedded in image history.secretsmanager:GetSecretValue on *.Produce a structured report with:
file:line | issue | severity | fix, then the top remediation.****. Use scanner --redact flags and read only secret metadata, never the value, unless a human explicitly requests it.aws secretsmanager put/delete, vault write, kubectl create secret) without explicit human approval.Provides UI/UX resources: 50+ styles, color palettes, font pairings, guidelines, charts for web/mobile across React, Next.js, Vue, Svelte, Tailwind, React Native, Flutter. Aids planning, building, reviewing interfaces.
Fetches up-to-date documentation from Context7 for libraries and frameworks like React, Next.js, Prisma. Use for setup questions, API references, and code examples.
npx claudepluginhub fluxonlab/skillry --plugin skillry-cloud-and-infrastructure