Skip to main content
ReferenceApplies to: Unified engine deployments
[secrets] The encryption key is stored at <storage_root>/secrets/master.key. It is created once. Keep it with the encrypted metadata. See storage.

​
Settings

​
secret_providers

Defines where named external secret references obtain their actual values.
  • Default: {}
  • Type: map
Example An environment provider can map secret name warehouse_token to environment variable WAREHOUSE_TOKEN. The provider resolves that variable when the secret is requested.

​
secret_providers.<name> entry

Defines a named way to fetch secret values from an environment, file, or external secret service.
  • Default: Set when used
  • Type: choice: environment, file, aws-secrets-manager, aws-ssm, azure-key-vault, gcp-secret-manager, vault
Example A provider named warehouse with type = "environment" can map secret names to environment variables. Its type decides which other fields are required.

​
Environment provider

​
secret_providers.<name>.variables (environment)

Maps secret names to environment variable names read by the provider.
  • Default: Set when used
  • Type: map
Example variables = { warehouse_token = "WAREHOUSE_TOKEN" } resolves warehouse_token from the process environment. The string is the variable name, not its value.

​
File provider

​
secret_providers.<name>.files (file)

Maps secret names to local files whose contents supply their values.
  • Default: Set when used
  • Type: map
Example Map warehouse_token to "/run/credentials/warehouse-token" when that file is mounted in the secrets host.

​
secret_providers.<name>.max_bytes (file)

Limits how much of a file the file secret provider will read.
  • Default: Set when used
  • Type: integer (bytes)
Example 1048576 allows a secret file up to 1 MiB, preventing an unexpectedly large file from becoming an unbounded secret read.

​
AWS Secrets Manager

Uses the Rust AWS SDK. The secret-service process supplies the runtime identity.

​
secret_providers.<name>.region (aws-secrets-manager)

  • Default: Unset; use the SDK Region chain
  • Type: string; optional

​
secret_providers.<name>.profile (aws-secrets-manager)

  • Default: Unset; use the SDK credential chain
  • Type: string; optional
Grant the runtime identity secretsmanager:GetSecretValue and any required KMS decryption permission. A reference may select a version ID.

​
AWS Parameter Store

Uses the Rust AWS SDK with decryption enabled for SecureString parameters.

​
secret_providers.<name>.region (aws-ssm)

  • Default: Unset; use the SDK Region chain
  • Type: string; optional

​
secret_providers.<name>.profile (aws-ssm)

  • Default: Unset; use the SDK credential chain
  • Type: string; optional
Grant the runtime identity ssm:GetParameter and any required KMS decryption permission. Explicit versions are positive integers.

​
Azure Key Vault

Uses the Rust Azure SDK.

​
secret_providers.<name>.vault_url (azure-key-vault)

  • Default: Set when used
  • Type: string
Use the complete endpoint, such as https://warehouse.vault.azure.net/.

​
secret_providers.<name>.authentication (azure-key-vault)

  • Default: workload-identity
  • Type: choice: workload-identity, managed-identity, client-secret
Workload identity uses the standard AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_FEDERATED_TOKEN_FILE settings. Managed identity uses the current workload’s managed identity. Client-secret authentication reads AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_CLIENT_SECRET from the secret-service process. Grant the selected identity permission to read the secret.

​
Google Secret Manager

Uses the Rust Google Cloud SDK with Application Default Credentials.

​
secret_providers.<name>.project (gcp-secret-manager)

  • Default: Set when used
  • Type: string
Grant the runtime identity permission to access secret versions in this project. The SDK reads workload identity or Application Default Credentials from the secret-service process. An omitted reference version requests latest.

​
HashiCorp Vault

Uses the Rust vaultrs client for KV v2.

​
secret_providers.<name>.address (vault)

  • Default: Set when used
  • Type: string
The Vault API endpoint, such as https://vault.example.com:8200.

​
secret_providers.<name>.token_env (vault)

  • Default: VAULT_TOKEN
  • Type: string
The name of the environment variable holding the API token. The token needs read permission for the selected KV paths. Set the variable in the secret-service process environment.

​
secret_providers.<name>.namespace (vault)

  • Default: Unset
  • Type: string; optional
The Vault namespace sent with requests.

​
secret_providers.<name>.mount (vault)

  • Default: Set when used
  • Type: string
The KV v2 mount. References contain the path within that mount. The provider returns the complete secret data object as JSON.

​
Migrate CLI provider configuration

Remove command from AWS Secrets Manager, Azure Key Vault, Google Secret Manager, and Vault provider entries. Move identity settings to the secret-service process or its SDK configuration. Old command fields are rejected at startup. For AWS, set region and optional profile when needed. For Azure, replace the vault name with vault_url and select authentication. Google keeps project. Vault keeps mount and adds address, optional token_env, and optional namespace. SQL references and saved local secrets keep their existing formats.
Last modified on November 4, 2026