Securely manage and reference secrets from AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager in your Terraform code.
ops0 integrates with cloud-native secret management services to help you securely handle sensitive values like API keys, database passwords, and certificates in your infrastructure code. Instead of hardcoding secrets, you can reference them from your cloud provider's secret manager.
Supported Secret Managers:
Link your AWS, Azure, or GCP account to your IaC project.
Use your cloud provider's console or CLI to create secrets tagged with ops0-managed.
ops0 displays available secrets that you can reference in your code.
Secret values are injected at deployment time without exposing them in logs or UI.
ops0-managed: true or name prefix ops0-Open your IaC project.
Click the Outputs/Secrets button in the toolbar.
Switch to the Secrets tab.
Select AWS as the provider.
ops0 displays all secrets from AWS Secrets Manager that match the filter criteria.
resource "aws_secretsmanager_secret" "database_password" {
name = "ops0-${var.project_name}-db-password"
description = "Database master password"
tags = {
"ops0-managed" = "true"
"ops0-project" = var.project_name
"environment" = "production"
}
}
resource "aws_secretsmanager_secret_version" "database_password" {
secret_id = aws_secretsmanager_secret.database_password.id
secret_string = random_password.db_password.result
}
Use the aws_secretsmanager_secret_version data source to reference existing secrets:
data "aws_secretsmanager_secret_version" "api_key" {
secret_id = "ops0-my-project-api-key"
}
resource "aws_lambda_function" "api" {
function_name = "my-api"
environment {
variables = {
API_KEY = data.aws_secretsmanager_secret_version.api_key.secret_string
}
}
}
ops0-managed: trueops0 uses your Azure service principal credentials to access Key Vault. Ensure your service principal has the Key Vault Secrets User role:
az role assignment create \
--role "Key Vault Secrets User" \
--assignee <service-principal-id> \
--scope /subscriptions/<subscription-id>/resourceGroups/<rg-name>/providers/Microsoft.KeyVault/vaults/<vault-name>
resource "azurerm_key_vault_secret" "database_password" {
name = "ops0-${var.project_name}-db-password"
value = random_password.db_password.result
key_vault_id = azurerm_key_vault.main.id
tags = {
"ops0-managed" = "true"
"ops0-project" = var.project_name
"ops0-secret-type" = "database-password"
}
}
data "azurerm_key_vault_secret" "api_key" {
name = "ops0-my-project-api-key"
key_vault_id = azurerm_key_vault.main.id
}
resource "azurerm_linux_web_app" "app" {
name = "my-app"
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
service_plan_id = azurerm_service_plan.main.id
app_settings = {
"API_KEY" = data.azurerm_key_vault_secret.api_key.value
}
}
ops0_managed: trueEnsure your GCP service account has the required role:
gcloud projects add-iam-policy-binding PROJECT_ID \
--member="serviceAccount:SERVICE_ACCOUNT_EMAIL" \
--role="roles/secretmanager.secretAccessor"
resource "google_secret_manager_secret" "database_password" {
secret_id = "ops0-${var.project_name}-db-password"
labels = {
ops0_managed = "true"
ops0_project = var.project_name
environment = "production"
}
replication {
auto {}
}
}
resource "google_secret_manager_secret_version" "database_password" {
secret = google_secret_manager_secret.database_password.id
secret_data = random_password.db_password.result
}
data "google_secret_manager_secret_version" "api_key" {
secret = "ops0-my-project-api-key"
}
resource "google_cloud_run_service" "api" {
name = "my-api"
location = "us-central1"
template {
spec {
containers {
image = "gcr.io/my-project/api:latest"
env {
name = "API_KEY"
value = data.google_secret_manager_secret_version.api_key.secret_data
}
}
}
}
}
Navigate to your IaC project.
Click Outputs/Secrets in the toolbar.
Switch to the Secrets tab.
Select your cloud provider (AWS/Azure/GCP).
| Field | Description |
|---|---|
| Secret name | The unique identifier |
| Resource type | Secret, API key, certificate, etc. |
| Provider | AWS, Azure, or GCP |
| Masked value | Secrets are never displayed in plain text |
Secret values are never displayed in the ops0 UI. Clicking "Copy" securely retrieves the value and places it in your clipboard.
To copy a secret value:
Click the Copy button next to the secret.
The value is securely fetched and copied to your clipboard.
Paste into your local development environment as needed.
Never store secrets in Terraform variables or hardcode them in your code.
Always tag secrets with ops0-managed to make them discoverable and manageable.
Set up automatic rotation policies in your cloud provider's secret manager.
Grant the minimum required permissions to service principals and users.
ops0 logs all secret retrievals for compliance and security auditing.
Use a consistent naming pattern for ops0-managed secrets:
ops0-{project-name}-{secret-type}
Examples:
ops0-my-app-db-passwordops0-my-app-api-keyops0-my-app-tls-certAdd metadata to secrets for better organization:
AWS:
tags = {
"ops0-managed" = "true"
"ops0-project" = "my-app"
"environment" = "production"
"secret-type" = "database-password"
}
Azure:
tags = {
"ops0-managed" = "true"
"ops0-project" = "my-app"
"ops0-secret-type" = "database-password"
}
GCP:
labels = {
ops0_managed = "true"
ops0_project = "my-app"
secret_type = "database_password"
}
Check:
ops0-managed: true or prefixed with ops0-secretsmanager:ListSecrets for AWS)Solutions:
secretsmanager:GetSecretValueSecret values are retrieved in real-time. If a value appears outdated:
latest version