> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets

> secrets

ReferenceApplies to: Unified engine deployments

`[secrets]`

The encryption key is stored at `<storage_root>/secrets/master.key`. It is created once. Keep it with the encrypted metadata. See [storage](https://docs.e6data.com/transformation/operations/configuration/storage.md).

## Settings

### `secret_providers`

Defines where named external secret references obtain their actual values.

* **Default:** `{}`
* **Type:** map

> **Example**
>
> An environment provider can map secret name `warehouse_token` to environment variable `WAREHOUSE_TOKEN`. The provider resolves that variable when the secret is requested.

### `secret_providers.<name>` entry

Defines a named way to fetch secret values from an environment, file, or external secret service.

* **Default:** Set when used
* **Type:** choice: `environment`, `file`, `aws-secrets-manager`, `aws-ssm`, `azure-key-vault`, `gcp-secret-manager`, `vault`

> **Example**
>
> A provider named `warehouse` with `type = "environment"` can map secret names to environment variables. Its type decides which other fields are required.

## Environment provider

### `secret_providers.<name>.variables (environment)`

Maps secret names to environment variable names read by the provider.

* **Default:** Set when used
* **Type:** map

> **Example**
>
> `variables = { warehouse_token = "WAREHOUSE_TOKEN" }` resolves warehouse\_token from the process environment. The string is the variable name, not its value.

## File provider

### `secret_providers.<name>.files (file)`

Maps secret names to local files whose contents supply their values.

* **Default:** Set when used
* **Type:** map

> **Example**
>
> Map warehouse\_token to `"/run/credentials/warehouse-token"` when that file is mounted in the secrets host.

### `secret_providers.<name>.max_bytes (file)`

Limits how much of a file the file secret provider will read.

* **Default:** Set when used
* **Type:** integer (bytes)

> **Example**
>
> `1048576` allows a secret file up to 1 MiB, preventing an unexpectedly large file from becoming an unbounded secret read.

## AWS Secrets Manager

Uses the Rust AWS SDK. The secret-service process supplies the runtime identity.

### `secret_providers.<name>.region (aws-secrets-manager)`

* **Default:** Unset; use the SDK Region chain
* **Type:** string; optional

### `secret_providers.<name>.profile (aws-secrets-manager)`

* **Default:** Unset; use the SDK credential chain
* **Type:** string; optional

```toml theme={"theme":{"light":"github-light","dark":"github-dark"}}
[secrets.secret_providers.warehouse]
type = "aws-secrets-manager"
region = "us-east-1"
```

Grant the runtime identity `secretsmanager:GetSecretValue` and any required
KMS decryption permission. A reference may select a version ID.

## AWS Parameter Store

Uses the Rust AWS SDK with decryption enabled for SecureString parameters.

### `secret_providers.<name>.region (aws-ssm)`

* **Default:** Unset; use the SDK Region chain
* **Type:** string; optional

### `secret_providers.<name>.profile (aws-ssm)`

* **Default:** Unset; use the SDK credential chain
* **Type:** string; optional

Grant the runtime identity `ssm:GetParameter` and any required KMS decryption
permission. Explicit versions are positive integers.

## Azure Key Vault

Uses the Rust Azure SDK.

### `secret_providers.<name>.vault_url (azure-key-vault)`

* **Default:** Set when used
* **Type:** string

Use the complete endpoint, such as `https://warehouse.vault.azure.net/`.

### `secret_providers.<name>.authentication (azure-key-vault)`

* **Default:** `workload-identity`
* **Type:** choice: `workload-identity`, `managed-identity`, `client-secret`

Workload identity uses the standard `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, and
`AZURE_FEDERATED_TOKEN_FILE` settings. Managed identity uses the current workload's
managed identity. Client-secret authentication reads `AZURE_TENANT_ID`,
`AZURE_CLIENT_ID`, and `AZURE_CLIENT_SECRET` from the secret-service process.
Grant the selected identity permission to read the secret.

```toml theme={"theme":{"light":"github-light","dark":"github-dark"}}
[secrets.secret_providers.warehouse]
type = "azure-key-vault"
vault_url = "https://warehouse.vault.azure.net/"
authentication = "workload-identity"
```

## Google Secret Manager

Uses the Rust Google Cloud SDK with Application Default Credentials.

### `secret_providers.<name>.project (gcp-secret-manager)`

* **Default:** Set when used
* **Type:** string

Grant the runtime identity permission to access secret versions in this project.
The SDK reads workload identity or Application Default Credentials from the
secret-service process. An omitted reference version requests `latest`.

## HashiCorp Vault

Uses the Rust `vaultrs` client for KV v2.

### `secret_providers.<name>.address (vault)`

* **Default:** Set when used
* **Type:** string

The Vault API endpoint, such as `https://vault.example.com:8200`.

### `secret_providers.<name>.token_env (vault)`

* **Default:** `VAULT_TOKEN`
* **Type:** string

The name of the environment variable holding the API token. The token needs read
permission for the selected KV paths. Set the variable in the secret-service
process environment.

### `secret_providers.<name>.namespace (vault)`

* **Default:** Unset
* **Type:** string; optional

The Vault namespace sent with requests.

### `secret_providers.<name>.mount (vault)`

* **Default:** Set when used
* **Type:** string

The KV v2 mount. References contain the path within that mount. The provider
returns the complete secret data object as JSON.

## Migrate CLI provider configuration

Remove `command` from AWS Secrets Manager, Azure Key Vault, Google Secret Manager,
and Vault provider entries. Move identity settings to the secret-service process
or its SDK configuration. Old command fields are rejected at startup.

For AWS, set `region` and optional `profile` when needed. For Azure, replace the
vault name with `vault_url` and select `authentication`. Google keeps `project`.
Vault keeps `mount` and adds `address`, optional `token_env`, and optional
`namespace`. SQL references and saved local secrets keep their existing formats.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.