{"id":51862629,"url":"https://github.com/basel5001/secret-vault","last_synced_at":"2026-07-24T10:01:46.650Z","repository":{"id":372128532,"uuid":"1285392460","full_name":"basel5001/secret-vault","owner":"basel5001","description":"HashiCorp Vault deployment as code: auto-unseal, secret rotation, K8s CSI integration","archived":false,"fork":false,"pushed_at":"2026-07-19T02:07:39.000Z","size":33,"stargazers_count":0,"open_issues_count":3,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-19T04:08:57.811Z","etag":null,"topics":["auto-rotation","aws-kms","hashicorp-vault","kubernetes","secrets-management","security","terraform"],"latest_commit_sha":null,"homepage":null,"language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/basel5001.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-30T18:58:36.000Z","updated_at":"2026-07-19T02:02:09.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/basel5001/secret-vault","commit_stats":null,"previous_names":["basel5001/secret-vault"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/basel5001/secret-vault","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/basel5001%2Fsecret-vault","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/basel5001%2Fsecret-vault/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/basel5001%2Fsecret-vault/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/basel5001%2Fsecret-vault/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/basel5001","download_url":"https://codeload.github.com/basel5001/secret-vault/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/basel5001%2Fsecret-vault/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35837268,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-24T02:00:07.870Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["auto-rotation","aws-kms","hashicorp-vault","kubernetes","secrets-management","security","terraform"],"created_at":"2026-07-24T10:01:46.583Z","updated_at":"2026-07-24T10:01:46.638Z","avatar_url":"https://github.com/basel5001.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Secret Vault\n\nSelf-hosted HashiCorp Vault deployment on AWS, fully managed as code with Terraform.\n\n## Architecture\n\n```\n                    ┌──────────────────────────────────────────┐\n                    │              AWS Account                  │\n                    │                                          │\n  Users/Apps ──────►│  ALB (TLS 1.3)                           │\n                    │      │                                   │\n                    │      ▼                                   │\n                    │  ┌─────────┐  ┌─────────┐  ┌─────────┐  │\n                    │  │  Vault  │  │  Vault  │  │  Vault  │  │\n                    │  │ (ECS)   │  │ (ECS)   │  │ (ECS)   │  │\n                    │  └────┬────┘  └────┬────┘  └────┬────┘  │\n                    │       │            │            │        │\n                    │       ▼            ▼            ▼        │\n                    │  ┌──────────────────────────────────┐    │\n                    │  │     DynamoDB (HA Backend)         │    │\n                    │  └──────────────────────────────────┘    │\n                    │                                          │\n                    │  ┌──────────┐  ┌───────────────────┐     │\n                    │  │ AWS KMS  │  │ CloudWatch Logs   │     │\n                    │  │(Unseal)  │  │ (Audit)           │     │\n                    │  └──────────┘  └───────────────────┘     │\n                    └──────────────────────────────────────────┘\n\n  Kubernetes ──────► Vault CSI Provider ──► Vault K8s Auth ──► Secrets\n```\n\n## Features\n\n- **ECS Fargate** deployment with auto-scaling\n- **AWS KMS auto-unseal** -- no manual unseal keys\n- **DynamoDB HA backend** with point-in-time recovery\n- **Dynamic secrets** for AWS IAM and PostgreSQL\n- **KV v2** secrets engine for static secrets\n- **Kubernetes CSI** integration for pod secret injection\n- **AppRole auth** for machine-to-machine authentication\n- **Audit logging** to CloudWatch\n- **Automated rotation** of root credentials\n- **Snapshot backups** to S3 with KMS encryption\n\n## Prerequisites\n\n- AWS CLI configured with appropriate permissions\n- Terraform \u003e= 1.5.0\n- Docker \u0026 Docker Compose (for local dev)\n- Vault CLI (optional, for direct interaction)\n\n## Quick Start\n\n### Local Development\n\n```bash\n# Start Vault in dev mode\nmake dev\n\n# Access UI at http://localhost:8200/ui (token: root)\n\n# Stop\nmake dev-down\n```\n\n### Production Deployment\n\n```bash\n# Copy and fill in environment variables\ncp .env.example .env\nsource .env\n\n# Initialize Terraform\nmake init\n\n# Review changes\nmake plan\n\n# Deploy\nmake apply\n\n# Initialize Vault (first time only)\nmake vault-init\n```\n\n## Secret Rotation\n\nDynamic secrets (AWS IAM, database credentials) are automatically rotated\nvia short-lived leases. To manually rotate root credentials:\n\n```bash\nmake rotate\n```\n\n## Backups\n\nCreate a Vault snapshot and upload to S3:\n\n```bash\nmake backup\n```\n\n## Kubernetes Integration\n\nEnable K8s integration in your `terraform.tfvars`:\n\n```hcl\nenable_k8s_integration = true\nk8s_cluster_name       = \"production\"\nkubernetes_host        = \"https://k8s-api.example.com\"\nk8s_app_namespaces     = [\"app-a\", \"app-b\", \"app-c\"]\n```\n\nPods mount secrets via the CSI driver:\n\n```yaml\nvolumes:\n  - name: vault-secrets\n    csi:\n      driver: secrets-store.csi.k8s.io\n      readOnly: true\n      volumeAttributes:\n        secretProviderClass: vault-secrets\n```\n\n## Policies\n\n| Policy       | Description                                         |\n| ------------ | --------------------------------------------------- |\n| `admin`      | Full access to all Vault paths                      |\n| `readonly`   | Read-only access to KV secrets                      |\n| `app-policy` | Namespace-scoped access for Kubernetes workloads     |\n| `rotation`   | Permission to rotate root credentials               |\n\n## Project Structure\n\n```\nsecret-vault/\n├── terraform/\n│   ├── main.tf                    # Root module\n│   ├── variables.tf               # Input variables\n│   ├── outputs.tf                 # Outputs\n│   ├── provider.tf                # Provider config\n│   ├── backend.tf                 # S3 state backend\n│   └── modules/\n│       ├── vault-cluster/         # ECS + ALB + DynamoDB + KMS\n│       ├── vault-secrets/         # Secrets engines + policies\n│       └── k8s-integration/       # CSI + K8s auth\n├── configs/\n│   └── vault-config.hcl           # Vault server configuration\n├── scripts/\n│   ├── init-vault.sh              # Initialize \u0026 store keys\n│   ├── rotate-secrets.sh          # Rotate dynamic secrets\n│   └── backup-vault.sh            # Snapshot to S3\n├── policies/\n│   ├── admin.hcl                  # Admin policy\n│   ├── readonly.hcl               # Read-only policy\n│   └── app-policy.hcl             # App (K8s-scoped) policy\n├── docker-compose.yml             # Local dev environment\n├── Makefile                       # Common operations\n└── .github/workflows/\n    ├── ci.yml                     # Validate + tfsec + shellcheck\n    └── security.yml               # Gitleaks secret scanning\n```\n\n## SOPS Integration\n\nFor GitOps-friendly encrypted secrets (secrets-in-git), see the [`sops/`](sops/) directory. SOPS allows you to commit encrypted secrets directly to Git using age or AWS KMS encryption, complementing Vault's dynamic secret capabilities.\n\n```bash\n# Encrypt a secrets file\n./sops/scripts/encrypt.sh my-secrets.yaml\n\n# Decrypt\n./sops/scripts/decrypt.sh sops/examples/secrets.enc.yaml\n```\n\nSee [`sops/README.md`](sops/README.md) for full documentation.\n\n## License\n\n[MIT](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbasel5001%2Fsecret-vault","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbasel5001%2Fsecret-vault","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbasel5001%2Fsecret-vault/lists"}