Secrets Vault Manager Skill

Secrets Vault Manager

Category: Engineering Domain: Secrets Management & Security

Overview

The Secrets Vault Manager skill provides tools for generating HashiCorp Vault configurations, planning and scheduling secret rotation cycles, and analyzing vault audit logs for suspicious access patterns. Essential for teams managing secrets at scale.

Clarify First

Before generating configs or plans, confirm these inputs. If any is unknown or vague, ASK — do not assume:

[ ] Task — config generation / rotation planning / audit-log analysis (selects the script and the entire workflow)
[ ] Environment & secrets engines — e.g. production + kv/database/transit (--env, --secrets-engines; shapes the generated HCL)
[ ] Secrets inventory & classification — Critical/High/Medium/Low per secret (drives rotation frequencies and the schedule)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

Quick Start

# Generate Vault configuration
python scripts/vault_config_generator.py --env production --secrets-engines kv,database,transit

# Plan secret rotation schedule
python scripts/rotation_planner.py --inventory secrets_inventory.json

# Analyze vault audit logs
python scripts/audit_log_analyzer.py --log-file vault_audit.log --format json

Tools Overview

| Tool | Purpose | Key Flags | |------|---------|-----------| | vault_config_generator.py | Generate HashiCorp Vault configurations | --env, --secrets-engines, --auth-methods | | rotation_planner.py | Plan and schedule secret rotation cycles | --inventory, --policy, --format | | audit_log_analyzer.py | Analyze vault audit logs for anomalies | --log-file, --time-range, --format |

Workflows

Initial Vault Setup

Define environment and required secrets engines
Run vault_config_generator.py to generate HCL configs
Review and customize generated configurations
Apply via Terraform or Vault CLI

Secret Rotation Planning

Create secrets inventory (JSON)
Run rotation_planner.py to generate schedule
Review rotation plan and adjust frequencies
Implement automated rotation where possible

Audit Log Investigation

Export vault audit logs
Run audit_log_analyzer.py for anomaly detection
Review flagged events
Investigate suspicious access patterns

Reference Documentation

Secrets Management Guide - Best practices, rotation policies, and compliance requirements

Common Patterns

Secret Classification

Critical: Database credentials, API master keys, encryption keys
High: Service account tokens, OAuth secrets, TLS certificates
Medium: Third-party API keys, webhook secrets
Low: Public API keys, non-sensitive configuration

Agent Skills: Secrets Vault Manager

Install this agent skill to your local

Skill Files