# Store and retrieve a secret
vault kv put secret/myapp/database username="dbadmin" password="s3cur3-p@ss"
vault kv get secret/myapp/database
vault kv get -version=2 secret/myapp/database   # Specific version
vault kv rollback -version=1 secret/myapp/database  # Restore

# Configure database secret engine
vault secrets enable database
vault write database/config/postgres \
  plugin_name=postgresql-database-plugin \
  connection_url="postgresql://{{username}}:{{password}}@db.internal:5432/prod" \
  allowed_roles="readonly" \
  username="vault_admin" \
  password="vault_admin_password"

# Role: credentials valid for 1 hour
vault write database/roles/readonly \
  db_name=postgres \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' \
    VALID UNTIL '{{expiration}}'; \
    GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  default_ttl="1h" \
  max_ttl="24h"

# Retrieve dynamic credentials -- automatically revoked after 1 hour
vault read database/creds/readonly

# Encryption as a Service
vault secrets enable transit
vault write -f transit/keys/payment-data
vault write transit/encrypt/payment-data plaintext=$(echo "NL91ABNA0417164300" | base64)

import hvac

client = hvac.Client(url='https://vault.internal:8200')
client.auth.approle.login(
    role_id='db02de05-c0f8-4d4b-a7c3-xxx',
    secret_id='6a174c20-f6de-a53c-74d2-xxx'
)

# Retrieve KV secret
secret = client.secrets.kv.v2.read_secret_version(
    path='myapp/database', mount_point='secret'
)
db_password = secret['data']['data']['password']

# Dynamic database credentials
creds = client.secrets.database.generate_credentials(
    name='readonly', mount_point='database'
)

import boto3, json

client = boto3.client('secretsmanager', region_name='eu-west-1')
response = client.get_secret_value(SecretId='prod/myapp/database')
secret = json.loads(response['SecretString'])

# Enable automatic rotation (30 days)
aws secretsmanager rotate-secret \
  --secret-id prod/myapp/database \
  --rotation-lambda-arn arn:aws:lambda:eu-west-1:111111111111:function:SecretsRotation \
  --rotation-rules '{"AutomaticallyAfterDays": 30}'

# SSM Parameter Store: cheaper alternative
aws ssm put-parameter --name "/prod/myapp/db-password" \
  --value "s3cur3-p@ss" --type SecureString --key-id alias/myapp-key

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

credential = DefaultAzureCredential()  # Managed identity in Azure
client = SecretClient(
    vault_url="https://myapp-vault.vault.azure.net/",
    credential=credential
)
secret = client.get_secret("database-password")
db_password = secret.value

from google.cloud import secretmanager

client = secretmanager.SecretManagerServiceClient()
name = "projects/my-project/secrets/database-password/versions/latest"
response = client.access_secret_version(request={"name": name})
db_password = response.payload.data.decode("UTF-8")

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy
        env:
          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}  # Automatically masked in logs
        run: ./deploy.sh

# GitHub Actions → AWS without long-lived keys
name: Deploy to AWS
on:
  push:
    branches: [main]

permissions:
  id-token: write   # Required for OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::111111111111:role/GitHubActions-Deploy
          aws-region: eu-west-1
          # No AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY needed
      - name: Deploy
        run: aws ecs update-service --cluster prod --service myapp --force-new-deployment

# Anyone with kubectl get secret can decode this:
kubectl get secret db-creds -o jsonpath='{.data.password}' | base64 -d

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-credentials
  namespace: production
spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: db-creds
    creationPolicy: Owner
  data:
    - secretKey: password
      remoteRef:
        key: secret/data/myapp/database
        property: password

apiVersion: v1
kind: Pod
metadata:
  name: myapp
  annotations:
    vault.hashicorp.com/agent-inject: "true"
    vault.hashicorp.com/role: "myapp"
    vault.hashicorp.com/agent-inject-secret-db-creds: "database/creds/readonly"
    vault.hashicorp.com/agent-inject-template-db-creds: |
      {{- with secret "database/creds/readonly" -}}
      postgresql://{{ .Data.username }}:{{ .Data.password }}@db:5432/prod
      {{- end }}
spec:
  containers:
    - name: myapp
      image: myapp:latest
      # Credentials available in /vault/secrets/db-creds

# WRONG: secret in image layer (even if you delete it later)
FROM python:3.12-slim
ENV DATABASE_URL=postgresql://admin:password123@db:5432/prod

# RIGHT: multi-stage build, secrets only in build stage
FROM python:3.12-slim AS builder
RUN --mount=type=secret,id=pip_token \
    PIP_INDEX_URL=https://$(cat /run/secrets/pip_token)@pypi.internal/simple/ \
    pip install -r requirements.txt

FROM python:3.12-slim
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY . .
# No secrets in the final image

import boto3

def lambda_handler(event, context):
    """AWS Secrets Manager rotation Lambda (4 steps)."""
    secret_id = event['SecretId']
    step = event['Step']
    client = boto3.client('secretsmanager')

    if step == "createSecret":
        new_password = client.get_random_password(
            PasswordLength=32, ExcludeCharacters='/@"\\',
        )['RandomPassword']
        client.put_secret_value(
            SecretId=secret_id,
            ClientRequestToken=event['ClientRequestToken'],
            SecretString=new_password,
            VersionStages=['AWSPENDING']
        )
    elif step == "setSecret":
        # Apply new password to the database
        pass  # ALTER USER ... PASSWORD ...
    elif step == "testSecret":
        # Verify that new credentials work
        pass
    elif step == "finishSecret":
        # Promote AWSPENDING → AWSCURRENT
        client.update_secret_version_stage(
            SecretId=secret_id, VersionStage='AWSCURRENT',
            MoveToVersionId=event['ClientRequestToken'],
        )

# gitleaks: scan for secrets
gitleaks detect --source . --verbose

# Pre-commit configuration (.pre-commit-config.yaml)
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

# trufflehog: deeper scan including git history
trufflehog git file://. --only-verified

# 1. IMMEDIATELY: rotate the leaked secret
# Don't wait. Do it now. Not after the standup.

# 2. Check if the secret was abused
# Check CloudTrail, Azure Activity Log, GCP Audit Logs

# 3. Remove from git history with BFG Repo-Cleaner
bfg --replace-text passwords.txt repo.git
cd repo.git && git reflog expire --expire=now --all
git gc --prune=now --aggressive && git push --force

# 4. ALL team members: delete local clone and re-clone
# 5. Document the incident