mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
merge deconflict
This commit is contained in:
Scott Wilson
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Available"
|
||||
openapi: "GET /api/v1/app-connections/terraform-cloud/available"
|
||||
---
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/app-connections/terraform-cloud"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Terraform Cloud Connections](/integrations/app-connections/terraform-cloud) to learn how to obtain
|
||||
the required credentials.
|
||||
</Note>
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/app-connections/terraform-cloud/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/app-connections/terraform-cloud/{connectionId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/app-connections/terraform-cloud/connection-name/{connectionName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/app-connections/terraform-cloud"
|
||||
---
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/app-connections/terraform-cloud/{connectionId}"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Check out the configuration docs for [Terraform Cloud Connections](/integrations/app-connections/terraform-cloud) to learn how to obtain
|
||||
the required credentials.
|
||||
</Note>
|
||||
4
docs/api-reference/endpoints/kms/signing/public-key.mdx
Normal file
4
docs/api-reference/endpoints/kms/signing/public-key.mdx
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Retrieve Public Key"
|
||||
openapi: "GET /api/v1/kms/keys/{keyId}/public-key"
|
||||
---
|
||||
4
docs/api-reference/endpoints/kms/signing/sign.mdx
Normal file
4
docs/api-reference/endpoints/kms/signing/sign.mdx
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Sign Data"
|
||||
openapi: "POST /api/v1/kms/keys/{keyId}/sign"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List Signing Algorithms"
|
||||
openapi: "GET /api/v1/kms/keys/{keyId}/signing-algorithms"
|
||||
---
|
||||
4
docs/api-reference/endpoints/kms/signing/verify.mdx
Normal file
4
docs/api-reference/endpoints/kms/signing/verify.mdx
Normal file
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Verify Signature"
|
||||
openapi: "POST /api/v1/kms/keys/{keyId}/verify"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/secret-syncs/terraform-cloud"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Delete"
|
||||
openapi: "DELETE /api/v1/secret-syncs/terraform-cloud/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by ID"
|
||||
openapi: "GET /api/v1/secret-syncs/terraform-cloud/{syncId}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Get by Name"
|
||||
openapi: "GET /api/v1/secret-syncs/terraform-cloud/sync-name/{syncName}"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "List"
|
||||
openapi: "GET /api/v1/secret-syncs/terraform-cloud"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Remove Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/terraform-cloud/{syncId}/remove-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Sync Secrets"
|
||||
openapi: "POST /api/v1/secret-syncs/terraform-cloud/{syncId}/sync-secrets"
|
||||
---
|
||||
@@ -0,0 +1,4 @@
|
||||
---
|
||||
title: "Update"
|
||||
openapi: "PATCH /api/v1/secret-syncs/terraform-cloud/{syncId}"
|
||||
---
|
||||
@@ -35,6 +35,10 @@ Create a user with the required permission in your SQL instance. This user will
|
||||
Maximum time-to-live for a generated secret
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Metadata" type="list" required>
|
||||
List of key/value metadata pairs
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Service" type="string" required>
|
||||
Choose the service you want to generate dynamic secrets for. This must be selected as **MS SQL**.
|
||||
</ParamField>
|
||||
|
||||
@@ -34,6 +34,10 @@ Create a user with the required permission in your SQL instance. This user will
|
||||
Maximum time-to-live for a generated secret
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Metadata" type="list" required>
|
||||
List of key/value metadata pairs
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Service" type="string" required>
|
||||
Choose the service you want to generate dynamic secrets for. This must be selected as **MySQL**.
|
||||
</ParamField>
|
||||
|
||||
@@ -34,6 +34,10 @@ Create a user with the required permission in your SQL instance. This user will
|
||||
Maximum time-to-live for a generated secret
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Metadata" type="list" required>
|
||||
List of key/value metadata pairs
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Service" type="string" required>
|
||||
Choose the service you want to generate dynamic secrets for. This must be selected as **Oracle**.
|
||||
</ParamField>
|
||||
@@ -62,7 +66,7 @@ Create a user with the required permission in your SQL instance. This user will
|
||||
A CA may be required if your DB requires it for incoming connections. AWS RDS instances with default settings will requires a CA which can be downloaded [here](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions).
|
||||
</ParamField>
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="(Optional) Modify SQL Statements">
|
||||
|
||||
@@ -35,6 +35,10 @@ Create a user with the required permission in your SQL instance. This user will
|
||||
Maximum time-to-live for a generated secret
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Metadata" type="list" required>
|
||||
List of key/value metadata pairs
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Service" type="string" required>
|
||||
Choose the service you want to generate dynamic secrets for. This must be selected as **PostgreSQL**.
|
||||
</ParamField>
|
||||
@@ -63,7 +67,7 @@ Create a user with the required permission in your SQL instance. This user will
|
||||
A CA may be required if your DB requires it for incoming connections. AWS RDS instances with default settings will requires a CA which can be downloaded [here](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions).
|
||||
</ParamField>
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="(Optional) Modify SQL Statements">
|
||||
|
||||
@@ -30,7 +30,9 @@ The typical workflow for using Infisical KMS consists of the following steps:
|
||||
as via API.
|
||||
</Note>
|
||||
|
||||
## Guide to Encrypting Data
|
||||
## Encryption
|
||||
|
||||
### Guide to Encrypting Data
|
||||
|
||||
In the following steps, we explore how to generate a key and use it to encrypt data.
|
||||
|
||||
@@ -44,7 +46,8 @@ In the following steps, we explore how to generate a key and use it to encrypt d
|
||||
Specify your key details. Here's some guidance on each field:
|
||||
|
||||
- Name: A slug-friendly name for the key.
|
||||
- Type: The encryption algorithm associated with the key (e.g. `AES-GCM-256`).
|
||||
- Key Usage: The type of key to create (e.g `Encrypt/Decrypt` for encryption, and `Sign/Verify` for signing).
|
||||
- Algorithm: The encryption algorithm associated with the key (e.g. `AES-GCM-256`).
|
||||
- Description: An optional description of what the intended usage is for the key.
|
||||
|
||||
|
||||
@@ -137,7 +140,7 @@ In the following steps, we explore how to generate a key and use it to encrypt d
|
||||
|
||||
</Tabs>
|
||||
|
||||
## Guide to Decrypting Data
|
||||
### Guide to Decrypting Data
|
||||
|
||||
In the following steps, we explore how to use decrypt data using an existing key in Infisical KMS.
|
||||
|
||||
@@ -193,6 +196,164 @@ In the following steps, we explore how to use decrypt data using an existing key
|
||||
|
||||
</Tabs>
|
||||
|
||||
## Signing
|
||||
|
||||
### Guide to Signing Data
|
||||
|
||||
In the following steps, we explore how to generate a key and use it to sign data.
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
<Steps>
|
||||
<Step title="Creating a KMS key">
|
||||
Navigate to Project > Key Management and tap on the **Add Key** button.
|
||||
|
||||
|
||||
Specify your key details. Here's some guidance on each field:
|
||||
|
||||
- Name: A slug-friendly name for the key.
|
||||
- Key Usage: The type of key to create (e.g `Encrypt/Decrypt` for encryption, and `Sign/Verify` for signing).
|
||||
- Algorithm: The signing algorithm associated with the key (e.g. `RSA_4096`).
|
||||
- Description: An optional description of what the intended usage is for the key.
|
||||
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Signing data with the KMS key">
|
||||
Once your key is generated, open the options menu for the newly created key and select sign data.
|
||||
|
||||
|
||||
Populate the text area with your data and tap on the Sign button.
|
||||
|
||||
|
||||
Make sure to select the appropriate signing algorithm that will be used to sign the data.
|
||||
Supported signing algorithms are:
|
||||
|
||||
**For RSA keys:**
|
||||
- `RSASSA PSS SHA 512`: Not deterministic, and includes random salt.
|
||||
- `RSASSA PSS SHA 384`: Not deterministic, and includes random salt.
|
||||
- `RSASSA PSS SHA 256`: Not deterministic, and includes random salt.
|
||||
- `RSASSA PKCS1 V1.5 SHA 512`: Deterministic, and does not include randomness.
|
||||
- `RSASSA PKCS1 V1.5 SHA 384`: Deterministic, and does not include randomness.
|
||||
- `RSASSA PKCS1 V1.5 SHA 256`: Deterministic, and does not include randomness.
|
||||
|
||||
**For ECC keys:**
|
||||
- `ECDSA SHA 512`: Not deterministic, and includes randomness.
|
||||
- `ECDSA SHA 384`: Not deterministic, and includes randomness.
|
||||
- `ECDSA SHA 256`: Not deterministic, and includes randomness.
|
||||
|
||||
In this example, we'll use the `RSASSA PSS SHA 512` signing algorithm.
|
||||
|
||||
<Note>
|
||||
If your data is already Base64 encoded make sure to toggle the respective switch on to avoid
|
||||
redundant encoding.
|
||||
</Note>
|
||||
|
||||
Copy and store the signature of your data.
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
<Steps>
|
||||
<Step title="Signing data">
|
||||
To sign data, make an API request to the [Sign
|
||||
Data](/api-reference/endpoints/kms/signing/sign) API endpoint,
|
||||
specifying the key to use.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/kms/keys/<key-id>/sign \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"data": "SGVsbG8sIFdvcmxkIQ==", // base64 encoded data
|
||||
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512",
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"signature": "JYuiBt1Ta9pbqFIW9Ou6qzBsFhjYbMJp9k4dP87ILrO+F2MPnp85g3nOlXK1ttZmRoGWsWnLNDRn9W3rf5VtkeaixPqUW/KvY/fM3CxdMyIV3BuxlGgDksjL8X34Eqkrz4CCPo9hjB5uT+rBCOxCgZqRbOdATPipAneUapI9npseNquEeh3jPklwviBix83PJHV9PW2t03AGGUXuMY55ZaFEIMv+IrI1WYdnPVIXDyIitYsS3y+/6KRfhVeTcPNJ5Rw+FE9y1eZzDEZtTNpxOfUT3QIoXmpZlYL4HbhRuJBZ+Yx54C7uPiUIN9U69XbyXt+Kkynykw2HPaagwuCZxiqCU5sFfLnrVbc3dmZxQcX2yRrs2gmFamzBx+uVbi648H4mb7WuE5UPTBjjA11jRsBjCY0YS2T4Vgfe1RlzlPQkZgjP/bnCCGDqXa3/VZAlZX1nTI51X995bPHBQI0rq2sNDlIXenwiAy1wJSITbSI8DbUx09Cr83xCEaYAE6R6PUfog/tbIUXi0VbrYsCVkAGCK446Wb1vW6q7HR8jrjXNwmXlqN9eLbSVWqdWj7N7fieeTYSrECtUaAjxtUYTIVsH2bfT6FOEM9gMWKffOpFowVzzr3B9bNQLIhnEEwebxBw947i4OcxyVIcEUuumWxoKvcbSPxzJ8v1M3SoBBh4=", // base64 encoded signature
|
||||
"keyId": "62b2c14e-58af-4199-9842-02995c63edf9",
|
||||
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512",
|
||||
}
|
||||
```
|
||||
|
||||
<Note>
|
||||
To sign predigested data, you can pass `"isDigest": true` in the request body. This requires the data to be a base64 encoded digest of the data you wish to sign.
|
||||
It's important that the digest is created using the same hashing algorithm as the signing algorithm. As an example, you would create the digest with `SHA512` if you are using the `RSASSA_PKCS1_V1_5_SHA_512` signing algorithm.
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
### Guide to Verifying Data
|
||||
|
||||
In the following steps, we explore how to verify data using an existing key in Infisical KMS.
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
<Steps>
|
||||
<Step title="Accessing your key">
|
||||
Navigate to Project > Key Management and open the options menu for the key used to sign the data
|
||||
you want to verify.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Verifying data with the KMS key">
|
||||
Paste your signature and data into the text areas and tap on the Verify button.
|
||||
|
||||
|
||||
Your verification result will be displayed and can be copied for use.
|
||||
|
||||
|
||||
If the signature is invalid, you'll see an error message indicating that the signature is invalid, and the "Signature Status" field will be `Invalid`.
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
<Steps>
|
||||
<Step title="Verifying data">
|
||||
To verify data, make an API request to the [Verify
|
||||
Data](/api-reference/endpoints/kms/signing/verify) API endpoint,
|
||||
specifying the key to use.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/kms/keys/<key-id>/verify \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"data": "SGVsbG8sIFdvcmxkIQ==", // base64 encoded data
|
||||
"signature": "JYuiBt1Ta9pbqFIW9Ou6qzBsFhjYbMJp9k4dP87ILrO+F2MPnp85g3nOlXK1ttZmRoGWsWnLNDRn9W3rf5VtkeaixPqUW/KvY/fM3CxdMyIV3BuxlGgDksjL8X34Eqkrz4CCPo9hjB5uT+rBCOxCgZqRbOdATPipAneUapI9npseNquEeh3jPklwviBix83PJHV9PW2t03AGGUXuMY55ZaFEIMv+IrI1WYdnPVIXDyIitYsS3y+/6KRfhVeTcPNJ5Rw+FE9y1eZzDEZtTNpxOfUT3QIoXmpZlYL4HbhRuJBZ+Yx54C7uPiUIN9U69XbyXt+Kkynykw2HPaagwuCZxiqCU5sFfLnrVbc3dmZxQcX2yRrs2gmFamzBx+uVbi648H4mb7WuE5UPTBjjA11jRsBjCY0YS2T4Vgfe1RlzlPQkZgjP/bnCCGDqXa3/VZAlZX1nTI51X995bPHBQI0rq2sNDlIXenwiAy1wJSITbSI8DbUx09Cr83xCEaYAE6R6PUfog/tbIUXi0VbrYsCVkAGCK446Wb1vW6q7HR8jrjXNwmXlqN9eLbSVWqdWj7N7fieeTYSrECtUaAjxtUYTIVsH2bfT6FOEM9gMWKffOpFowVzzr3B9bNQLIhnEEwebxBw947i4OcxyVIcEUuumWxoKvcbSPxzJ8v1M3SoBBh4=", // base64 encoded signature
|
||||
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512"
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"signatureValid": true,
|
||||
"keyId": "62b2c14e-58af-4199-9842-02995c63edf9",
|
||||
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512"
|
||||
}
|
||||
```
|
||||
<Note>
|
||||
To verify predigested data, you can pass `"isDigest": true` in the request body. This requires the data to be a base64 encoded digest of the data you wish to verify.
|
||||
It's important that the digest is created using the same hashing algorithm as the signing algorithm. As an example, you would create the digest with `SHA512` if you are using the `RSASSA_PKCS1_V1_5_SHA_512` signing algorithm.
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
## FAQ
|
||||
|
||||
<AccordionGroup>
|
||||
@@ -205,8 +366,76 @@ In the following steps, we explore how to use decrypt data using an existing key
|
||||
external sources.
|
||||
</Accordion>
|
||||
<Accordion title="What algorithms does Infisical KMS support?">
|
||||
Currently, Infisical only supports `AES-128-GCM` and `AES-256-GCM` for
|
||||
encryption operations. We anticipate supporting more algorithms and
|
||||
cryptographic operations in the coming months.
|
||||
Currently Infisical supports 4 different key algorithms with different purposes:
|
||||
|
||||
- `RSA_4096`: For signing and verifying data.
|
||||
- `ECC_NIST_P256`: For signing and verifying data.
|
||||
|
||||
- `AES-256-GCM`: For encryption and decryption operations.
|
||||
- `AES-128-GCM`: For encryption and decryption operations.
|
||||
|
||||
We anticipate to further expand our supported algorithms and support cryptographic operations in the future.
|
||||
</Accordion>
|
||||
<Accordion title="How do I sign and verify a digest using the Infisical KMS?">
|
||||
To sign and verify a digest using the Infisical KMS, you can use the `Sign` and `Verify` endpoints respectively.
|
||||
You will need to pass `"isDigest": true` in the request body to indicate that you are signing or verifying a digest.
|
||||
The data you are signing or verifying will need to be a base64 encoded digest of the data you wish to sign or verify.
|
||||
It's important that the digest is created using the same hashing algorithm as the signing algorithm. As an example, you would create the digest with `SHA512` if you are using the `RSASSA_PKCS1_V1_5_SHA_512` signing algorithm.
|
||||
|
||||
To create a SHA512 digest of your data, you can use the following command with OpenSSL:
|
||||
```bash
|
||||
echo -n "Hello, World" | openssl dgst -sha512 -binary | openssl base64
|
||||
```
|
||||
|
||||
### Sample request for signing a digest
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/kms/keys/<key-id>/sign \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"data": <digest-output-of-openssl-command>,
|
||||
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512",
|
||||
"isDigest": true
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response for signing a digest
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"signature": <base64-encoded-signature>,
|
||||
"keyId": <key-id>,
|
||||
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512"
|
||||
}
|
||||
```
|
||||
|
||||
### Sample request for verifying a digest
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/kms/keys/<key-id>/verify \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"data": <digest-output-of-openssl-command>,
|
||||
"signature": <base64-encoded-signature>,
|
||||
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512",
|
||||
"isDigest": true
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response for verifying a digest
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"signatureValid": true,
|
||||
"keyId": <key-id>,
|
||||
"signingAlgorithm": "RSASSA_PKCS1_V1_5_SHA_512"
|
||||
}
|
||||
```
|
||||
|
||||
<Note>
|
||||
Please note that `RSA PSS` signing algorithms are not supported for digest signing and verification. Please use `RSA PKCS1 V1.5` signing algorithms for digest signing and verification, or `ECDSA` if you're using an ECC key.
|
||||
</Note>
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 241 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 909 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 573 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 581 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 391 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 345 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 311 KiB |
BIN
docs/images/integrations/external/backstage/backstage-plugin-infisical.png
vendored
Normal file
BIN
docs/images/integrations/external/backstage/backstage-plugin-infisical.png
vendored
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 548 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 72 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 156 KiB After Width: | Height: | Size: 595 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 593 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 596 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 187 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 295 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 195 KiB |
BIN
docs/images/platform/kms/infisical-kms/signing/sign-options.png
Normal file
BIN
docs/images/platform/kms/infisical-kms/signing/sign-options.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 279 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 295 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 306 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 1.0 MiB |
Binary file not shown.
|
After Width: | Height: | Size: 633 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 608 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 634 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 667 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 639 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 604 KiB |
@@ -56,7 +56,15 @@ Infisical supports two methods for connecting to AWS.
|
||||
|
||||
2. Select **AWS Account** as the **Trusted Entity Type**.
|
||||
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
|
||||
4. Optionally, enable **Require external ID** and enter your **Organization ID** to further enhance security.
|
||||
4. (Recommended) <strong>Enable "Require external ID"</strong> and input your **Organization ID** to strengthen security and mitigate the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html).
|
||||
|
||||
<Warning type="warning" title="Security Best Practice: Use External ID to Prevent Confused Deputy Attacks">
|
||||
When configuring an IAM Role that Infisical will assume, it’s highly recommended to enable the **"Require external ID"** option and specify your **Organization ID**.
|
||||
|
||||
This precaution helps protect your AWS account against the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html), a potential security vulnerability where Infisical could be tricked into performing actions on your behalf by an unauthorized actor.
|
||||
|
||||
<strong>Always enable "Require external ID" and use your Organization ID when setting up the IAM Role.</strong>
|
||||
</Warning>
|
||||
</Step>
|
||||
|
||||
<Step title="Add Required Permissions to the IAM Role">
|
||||
|
||||
@@ -51,6 +51,10 @@ Infisical supports connecting to Microsoft SQL Server using database principals.
|
||||
- `username` - The username of the login created in the steps above
|
||||
- `password` - The password of the login created in the steps above
|
||||
- `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
|
||||
|
||||
<Note>
|
||||
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
|
||||
@@ -41,6 +41,10 @@ Infisical supports connecting to PostgreSQL using a database role.
|
||||
- `username` - The role name of the login created in the steps above
|
||||
- `password` - The role password of the login created in the steps above
|
||||
- `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
|
||||
|
||||
<Note>
|
||||
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
|
||||
83
docs/integrations/app-connections/terraform-cloud.mdx
Normal file
83
docs/integrations/app-connections/terraform-cloud.mdx
Normal file
@@ -0,0 +1,83 @@
|
||||
---
|
||||
title: "Terraform Cloud Connection"
|
||||
description: "Learn how to configure a Terraform Cloud Connection for Infisical."
|
||||
---
|
||||
|
||||
Infisical supports connecting to Terraform Cloud using a service user.
|
||||
|
||||
## Setup Terraform Cloud Connection in Infisical
|
||||
|
||||
<Steps>
|
||||
<Step title="Move to Account Settings on Terraform Cloud">
|
||||
Navigate to the Terraform Cloud **Account Settings** tab.
|
||||
|
||||
</Step>
|
||||
<Step title="Move to Tokens Tab">
|
||||
Move to the **Tokens** tab.
|
||||
|
||||
</Step>
|
||||
<Step title="Create the API Token">
|
||||
Create the API token to be used by Infisical.
|
||||
<Note>
|
||||
If you configure an expiry date for your API token you will need to manually rotate to a new token prior to expiration to avoid integration downtime.
|
||||
</Note>
|
||||
|
||||
</Step>
|
||||
<Step title="Copy the API Token">
|
||||
The API token will be displayed after creating it. Save the token in a secure location for later use in the following steps.
|
||||
|
||||
</Step>
|
||||
<Step title="Add Terraform Cloud Connection in Infisical">
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to the **App Connections** tab on the **Organization Settings** page.
|
||||
|
||||
2. Select the **Terraform Cloud Connection** option from the connection options modal.
|
||||
|
||||
3. Fill out the Terraform Cloud Connection modal, here you will need to provide the API Token generated in the previous step.
|
||||
|
||||
4. Your **Terraform Cloud Connection** is now available for use.
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an Terraform Cloud Connection, make an API request to the [Create Terraform Cloud
|
||||
Connection](/api-reference/endpoints/app-connections/terraform-cloud/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/app-connections/terraform-cloud \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-terraform-cloud-connection",
|
||||
"method": "api-token",
|
||||
"credentials": {
|
||||
"apiToken": "...",
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"appConnection": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-terraform-cloud-connection",
|
||||
"version": 123,
|
||||
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"app": "terraform-cloud",
|
||||
"method": "api-token",
|
||||
"credentials": {
|
||||
"apiToken": "..."
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
</Step>
|
||||
</Steps>
|
||||
@@ -3,197 +3,6 @@ title: "AWS Parameter Store"
|
||||
description: "Learn how to sync secrets from Infisical to AWS Parameter Store."
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Assume Role (Recommended)">
|
||||
Infisical will assume the provided role in your AWS account securely, without the need to share any credentials.
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Accordion title="Self-Hosted Users">
|
||||
To connect your Infisical instance with AWS, you need to set up an AWS IAM User account that can assume the AWS IAM Role for the integration.
|
||||
|
||||
If your instance is deployed on AWS, the aws-sdk will automatically retrieve the credentials. Ensure that you assign the provided permission policy to your deployed instance, such as ECS or EC2.
|
||||
|
||||
The following steps are for instances not deployed on AWS
|
||||
<Steps>
|
||||
<Step title="Create an IAM User">
|
||||
Navigate to [Create IAM User](https://console.aws.amazon.com/iamv2/home#/users/create) in your AWS Console.
|
||||
</Step>
|
||||
<Step title="Create an Inline Policy">
|
||||
Attach the following inline permission policy to the IAM User to allow it to assume any IAM Roles:
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowAssumeAnyRole",
|
||||
"Effect": "Allow",
|
||||
"Action": "sts:AssumeRole",
|
||||
"Resource": "arn:aws:iam::*:role/*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
</Step>
|
||||
<Step title="Obtain the IAM User Credentials">
|
||||
Obtain the AWS access key ID and secret access key for your IAM User by navigating to IAM > Users > [Your User] > Security credentials > Access keys.
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Set Up Integration Keys">
|
||||
1. Set the access key as **CLIENT_ID_AWS_INTEGRATION**.
|
||||
2. Set the secret key as **CLIENT_SECRET_AWS_INTEGRATION**.
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
|
||||
<Steps>
|
||||
<Step title="Create the Managing User IAM Role for AWS Parameter Store">
|
||||
1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console.
|
||||
|
||||
|
||||
2. Select **AWS Account** as the **Trusted Entity Type**.
|
||||
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
|
||||
4. Optionally, enable **Require external ID** and enter your **project ID** to further enhance security.
|
||||
</Step>
|
||||
|
||||
<Step title="Add Required Permissions for the IAM Role">
|
||||
|
||||
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Parameter Store:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowSSMAccess",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ssm:PutParameter",
|
||||
"ssm:DeleteParameter",
|
||||
"ssm:GetParameters",
|
||||
"ssm:GetParametersByPath",
|
||||
"ssm:DescribeParameters",
|
||||
"ssm:DeleteParameters",
|
||||
"ssm:AddTagsToResource", // if you need to add tags to secrets
|
||||
"kms:ListKeys", // if you need to specify the KMS key
|
||||
"kms:ListAliases", // if you need to specify the KMS key
|
||||
"kms:Encrypt", // if you need to specify the KMS key
|
||||
"kms:Decrypt" // if you need to specify the KMS key
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
</Step>
|
||||
|
||||
<Step title="Copy the AWS IAM Role ARN">
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Authorize Infisical for AWS Parameter Store">
|
||||
1. Navigate to your project's integrations tab in Infisical.
|
||||
2. Click on the **AWS Parameter Store** tile.
|
||||
|
||||
|
||||
3. Select the **AWS Assume Role** option.
|
||||
|
||||
|
||||
4. Provide the **AWS IAM Role ARN** obtained from the previous step and press connect.
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select which Infisical environment secrets you want to sync to which AWS Parameter Store region and indicate the path for your secrets. Then, press create integration to start syncing secrets to AWS Parameter Store.
|
||||
|
||||
|
||||
|
||||
<Tip>
|
||||
Infisical requires you to add a path for your secrets to be stored in AWS
|
||||
Parameter Store and recommends setting the path structure to
|
||||
`/[project_name]/[environment]/` according to best practices. This enables a
|
||||
secret like `TEST` to be stored as `/[project_name]/[environment]/TEST` in AWS
|
||||
Parameter Store.
|
||||
</Tip>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Access Key">
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Steps>
|
||||
<Step title="Grant the IAM user permissions to access AWS Parameter Store">
|
||||
Navigate to your IAM user permissions and add a permission policy to grant access to AWS Parameter Store.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
For enhanced security, here's a custom policy containing the minimum permissions required by Infisical to sync secrets to AWS Parameter Store for the IAM user that you can use:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowSSMAccess",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ssm:PutParameter",
|
||||
"ssm:DeleteParameter",
|
||||
"ssm:GetParameters",
|
||||
"ssm:GetParametersByPath",
|
||||
"ssm:DescribeParameters",
|
||||
"ssm:DeleteParameters",
|
||||
"ssm:AddTagsToResource", // if you need to add tags to secrets
|
||||
"kms:ListKeys", // if you need to specify the KMS key
|
||||
"kms:ListAliases", // if you need to specify the KMS key
|
||||
"kms:Encrypt", // if you need to specify the KMS key
|
||||
"kms:Decrypt" // if you need to specify the KMS key
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
</Step>
|
||||
<Step title="Authorize Infisical for AWS Parameter store">
|
||||
Obtain a AWS access key ID and secret access key for your IAM user in IAM > Users > User > Security credentials > Access keys
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the AWS Parameter Store tile and select Access Key as the authentication mode. Input your AWS access key ID and secret access key from the previous step.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select which Infisical environment secrets you want to sync to which AWS Parameter Store region and indicate the path for your secrets. Then, press create integration to start syncing secrets to AWS Parameter Store.
|
||||
|
||||
|
||||
|
||||
<Tip>
|
||||
Infisical requires you to add a path for your secrets to be stored in AWS
|
||||
Parameter Store and recommends setting the path structure to
|
||||
`/[project_name]/[environment]/` according to best practices. This enables a
|
||||
secret like `TEST` to be stored as `/[project_name]/[environment]/TEST` in AWS
|
||||
Parameter Store.
|
||||
</Tip>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
<Note>
|
||||
The AWS Parameter Store Native Integration will be deprecated in 2026. Please migrate to our new [AWS Parameter Store Sync](../secret-syncs/aws-parameter-store).
|
||||
</Note>
|
||||
@@ -3,269 +3,6 @@ title: "AWS Secrets Manager"
|
||||
description: "Learn how to sync secrets from Infisical to AWS Secrets Manager."
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Assume Role (Recommended)">
|
||||
Infisical will assume the provided role in your AWS account securely, without the need to share any credentials.
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Accordion title="Self-Hosted Users">
|
||||
To connect your Infisical instance with AWS, you need to set up an AWS IAM User account that can assume the AWS IAM Role for the integration.
|
||||
|
||||
If your instance is deployed on AWS, the aws-sdk will automatically retrieve the credentials. Ensure that you assign the provided permission policy to your deployed instance, such as ECS or EC2.
|
||||
|
||||
The following steps are for instances not deployed on AWS
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an IAM User">
|
||||
Navigate to [Create IAM User](https://console.aws.amazon.com/iamv2/home#/users/create) in your AWS Console.
|
||||
</Step>
|
||||
<Step title="Create an Inline Policy">
|
||||
Attach the following inline permission policy to the IAM User to allow it to assume any IAM Roles:
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowAssumeAnyRole",
|
||||
"Effect": "Allow",
|
||||
"Action": "sts:AssumeRole",
|
||||
"Resource": "arn:aws:iam::*:role/*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
</Step>
|
||||
<Step title="Obtain the IAM User Credentials">
|
||||
Obtain the AWS access key ID and secret access key for your IAM User by navigating to IAM > Users > [Your User] > Security credentials > Access keys.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Set Up Integration Keys">
|
||||
1. Set the access key as **CLIENT_ID_AWS_INTEGRATION**.
|
||||
2. Set the secret key as **CLIENT_SECRET_AWS_INTEGRATION**.
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
|
||||
<Steps>
|
||||
<Step title="Create the Managing User IAM Role for AWS Secrets Manager">
|
||||
1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console.
|
||||
|
||||
|
||||
2. Select **AWS Account** as the **Trusted Entity Type**.
|
||||
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
|
||||
4. Optionally, enable **Require external ID** and enter your **project ID** to further enhance security.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Add Required Permissions for the IAM Role">
|
||||
|
||||
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowSecretsManagerAccess",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"secretsmanager:GetSecretValue",
|
||||
"secretsmanager:CreateSecret",
|
||||
"secretsmanager:UpdateSecret",
|
||||
"secretsmanager:DescribeSecret",
|
||||
"secretsmanager:TagResource",
|
||||
"secretsmanager:UntagResource",
|
||||
"kms:ListKeys",
|
||||
"kms:ListAliases",
|
||||
"kms:Encrypt",
|
||||
"kms:Decrypt"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Copy the AWS IAM Role ARN">
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Authorize Infisical for AWS Secrets Manager">
|
||||
1. Navigate to your project's integrations tab in Infisical.
|
||||
2. Click on the **AWS Secrets Manager** tile.
|
||||
|
||||
|
||||
3. Select the **AWS Assume Role** option.
|
||||
|
||||
|
||||
4. Provide the **AWS IAM Role ARN** obtained from the previous step.
|
||||
|
||||
</Step> <Step title="Start integration">
|
||||
Select how you want to integration to work by specifying a number of parameters:
|
||||
|
||||
<ParamField path="Project Environment" type="string" required>
|
||||
The environment in Infisical from which you want to sync secrets to AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="Secrets Path" type="string" required>
|
||||
The path within the preselected environment form which you want to sync secrets to AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="AWS Region" type="string" required>
|
||||
The region that you want to integrate with in AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="Mapping Behavior" type="string" required>
|
||||
How you want the integration to map the secrets. The selected value could be either one to one or one to many.
|
||||
</ParamField>
|
||||
<ParamField path="AWS SM Secret Name" type="string" required>
|
||||
The secret name/path in AWS into which you want to sync the secrets from Infisical.
|
||||
</ParamField>
|
||||
|
||||
|
||||
|
||||
Optionally, you can add tags or specify the encryption key of all the secrets created via this integration:
|
||||
|
||||
<ParamField path="Tag Sync Mode" type="string" optional>
|
||||
The sync mode for AWS tags. The supported options are `Secret Metadata` and `Custom`. If `Secret Metadata` is selected,
|
||||
the metadata of the Infisical secrets are used as tags in AWS. If custom is selected, then the key/value of the **Secret Tag** field is used. `Secret Metadata` mode
|
||||
is only supported for one-to-one integrations.
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Secret Tag" type="string" optional>
|
||||
The Key/Value of a tag that will be added to secrets in AWS. Please note that it is possible to add multiple tags via API.
|
||||
</ParamField>
|
||||
<ParamField path="Encryption Key" type="string" optional>
|
||||
The alias/ID of the AWS KMS key used for encryption. Please note that key should be enabled in order to work and the IAM user should have access to it.
|
||||
</ParamField>
|
||||
|
||||
|
||||
Then, press `Create Integration` to start syncing secrets to AWS Secrets Manager.
|
||||
|
||||
<Info>
|
||||
Infisical currently syncs environment variables to AWS Secrets Manager as
|
||||
key-value pairs under one secret. We're actively exploring ways to help users
|
||||
group environment variable key-pairs under multiple secrets for greater
|
||||
control.
|
||||
</Info>
|
||||
<Info>
|
||||
Please note that upon deleting secrets in Infisical, AWS Secrets Manager immediately makes the secrets inaccessible but only schedules them for deletion after at least 7 days.
|
||||
</Info>
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
<Tab title="Access Key">
|
||||
Infisical will access your account using the provided AWS access key and secret key.
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
- Set up AWS and have/create an IAM user
|
||||
|
||||
<Steps>
|
||||
<Step title="Grant the IAM user permissions to access AWS Secrets Manager">
|
||||
Navigate to your IAM user permissions and add a permission policy to grant access to AWS Secrets Manager.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
For better security, here's a custom policy containing the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager for the IAM user that you can use:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowSecretsManagerAccess",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"secretsmanager:GetSecretValue",
|
||||
"secretsmanager:CreateSecret",
|
||||
"secretsmanager:UpdateSecret",
|
||||
"secretsmanager:DescribeSecret", // if you need to add tags to secrets
|
||||
"secretsmanager:TagResource", // if you need to add tags to secrets
|
||||
"secretsmanager:UntagResource", // if you need to add tags to secrets
|
||||
"kms:ListKeys", // if you need to specify the KMS key
|
||||
"kms:ListAliases", // if you need to specify the KMS key
|
||||
"kms:Encrypt", // if you need to specify the KMS key
|
||||
"kms:Decrypt" // if you need to specify the KMS key
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
</Step>
|
||||
<Step title="Authorize Infisical for AWS Secrets Manager">
|
||||
Obtain a AWS access key ID and secret access key for your IAM user in IAM > Users > User > Security credentials > Access keys
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
1. Navigate to your project's integrations tab in Infisical.
|
||||
2. Click on the **AWS Secrets Manager** tile.
|
||||
|
||||
|
||||
3. Select the **Access Key** option for Authentication Mode.
|
||||
|
||||
4. Provide the **access key** and **secret key** for the AWS Iam User.
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select how you want to integration to work by specifying a number of parameters:
|
||||
|
||||
<ParamField path="Project Environment" type="string" required>
|
||||
The environment in Infisical from which you want to sync secrets to AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="Secrets Path" type="string" required>
|
||||
The path within the preselected environment form which you want to sync secrets to AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="AWS Region" type="string" required>
|
||||
The region that you want to integrate with in AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="Mapping Behavior" type="string" required>
|
||||
How you want the integration to map the secrets. The selected value could be either one to one or one to many.
|
||||
</ParamField>
|
||||
<ParamField path="AWS SM Secret Name" type="string" required>
|
||||
The secret name/path in AWS into which you want to sync the secrets from Infisical.
|
||||
</ParamField>
|
||||
|
||||
|
||||
|
||||
Optionally, you can add tags or specify the encryption key of all the secrets created via this integration:
|
||||
|
||||
<ParamField path="Secret Tag" type="string" optional>
|
||||
The Key/Value of a tag that will be added to secrets in AWS. Please note that it is possible to add multiple tags via API.
|
||||
</ParamField>
|
||||
<ParamField path="Encryption Key" type="string" optional>
|
||||
The alias/ID of the AWS KMS key used for encryption. Please note that key should be enabled in order to work and the IAM user should have access to it.
|
||||
</ParamField>
|
||||
|
||||
|
||||
Then, press `Create Integration` to start syncing secrets to AWS Secrets Manager.
|
||||
|
||||
<Info>
|
||||
Infisical currently syncs environment variables to AWS Secrets Manager as
|
||||
key-value pairs under one secret. We're actively exploring ways to help users
|
||||
group environment variable key-pairs under multiple secrets for greater
|
||||
control.
|
||||
</Info>
|
||||
<Info>
|
||||
Please note that upon deleting secrets in Infisical, AWS Secrets Manager immediately makes the secrets inaccessible but only schedules them for deletion after at least 7 days.
|
||||
</Info>
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
<Note>
|
||||
The AWS Secrets Manager Native Integration will be deprecated in 2026. Please migrate to our new [AWS Secrets Manager Sync](../secret-syncs/aws-secrets-manager).
|
||||
</Note>
|
||||
@@ -3,110 +3,6 @@ title: "Azure App Configuration"
|
||||
description: "How to sync secrets from Infisical to Azure App Configuration"
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Usage">
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com).
|
||||
- Set up Azure and have an existing App Configuration instance.
|
||||
- User setting up the integration on Infisical must have the `App Configuration Data Owner` role for the intended Azure App Configuration instance.
|
||||
- Azure App Configuration instance must be reachable by Infisical.
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for Azure App Configuration">
|
||||
Navigate to your project's integrations tab
|
||||
|
||||
|
||||
|
||||
Press on the Azure App Configuration tile and grant Infisical access to App Configuration.
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Obtain the Azure App Configuration endpoint from the overview tab.
|
||||
|
||||
|
||||
Select which Infisical environment secrets you want to sync to your Azure App Configuration. Then, input your App Configuration instance endpoint. Optionally, you can define a prefix for your secrets which will be appended to the keys upon syncing.
|
||||
|
||||
|
||||
|
||||
Press create integration to start syncing secrets to Azure App Configuration.
|
||||
|
||||
<Warning>
|
||||
The Azure App Configuration integration requires the following permissions to be set on the user / service principal
|
||||
for Infisical to sync secrets to Azure App Configuration: `Read Key-Value`, `Write Key-Value`, `Delete Key-Value`.
|
||||
|
||||
Any role with these permissions would work such as the **App Configuration Data Owner** role. Alternatively, you can use the
|
||||
**App Configuration Data Reader** role for read-only access or **App Configuration Data Contributor** role for read/write access.
|
||||
</Warning>
|
||||
|
||||
</Step>
|
||||
<Step title="Additional Configuration">
|
||||
|
||||
#### Azure references
|
||||
When adding secrets in Infisical that reference Azure Key Vault secrets, Infisical will automatically sets the content type to `application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8` in Azure App Configuration.
|
||||
The following reference formats are automatically detected when added on Infisical's side:
|
||||
- `{ "uri": "https://my-key-vault.vault.azure.net/secrets/my-secret" }`
|
||||
- `https://my-key-vault.vault.azure.net/secrets/my-secret`
|
||||
|
||||
#### Azure Labels
|
||||
You can sync secrets from Infisical to Azure with custom labels by enabling the `Use Labels` option during setup:
|
||||
|
||||
**When enabled**: Secrets will be pushed to Azure with your specified label
|
||||
|
||||
**When disabled**: Secrets will be pushed with an empty (null) label
|
||||
|
||||
<Info>
|
||||
If you have set the initial sync to `import` have behavior, the label selection affects which secrets are imported from Azure:
|
||||
- With `Use Labels` disabled: Only secrets with empty labels are imported on initial sync
|
||||
- With `Use Labels` enabled: Only secrets matching your specified label are imported on initial sync
|
||||
</Info>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Self-Hosted Setup">
|
||||
Using the Azure App Configuration integration on a self-hosted instance of Infisical requires configuring an application in Azure
|
||||
and registering your instance with it.
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up Azure and have an existing App Configuration instance.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an application in Azure">
|
||||
Navigate to Azure Active Directory > App registrations to create a new application.
|
||||
|
||||
<Info>
|
||||
Azure Active Directory is now Microsoft Entra ID.
|
||||
</Info>
|
||||
|
||||
|
||||
|
||||
Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/integrations/azure-app-configuration/oauth2/callback`.
|
||||
<Tip>
|
||||
The domain you defined in the Redirect URI should be equivalent to the `SITE_URL` configured in your Infisical instance.
|
||||
</Tip>
|
||||
|
||||
|
||||
|
||||
After registration, set the API permissions of the app to include the following Azure App Configuration permissions: KeyValue.Delete, KeyValue.Read, and KeyValue.Write.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add your application credentials to Infisical">
|
||||
Obtain the **Application (Client) ID** in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Back in your Infisical instance, add two new environment variables for the credentials of your Azure application.
|
||||
|
||||
- `CLIENT_ID_AZURE`: The **Application (Client) ID** of your Azure application.
|
||||
- `CLIENT_SECRET_AZURE`: The **Client Secret** of your Azure application.
|
||||
|
||||
Once added, restart your Infisical instance and use the Azure App Configuration integration.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
<Note>
|
||||
The Azure App Configuration Native Integration will be deprecated in 2026. Please migrate to our new [Azure App Configuration Sync](../secret-syncs/azure-app-configuration).
|
||||
</Note>
|
||||
@@ -3,79 +3,6 @@ title: "Azure Key Vault"
|
||||
description: "How to sync secrets from Infisical to Azure Key Vault"
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Usage">
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
- Set up Azure and have an existing key vault
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for Azure Key Vault">
|
||||
Navigate to your project's integrations tab
|
||||
|
||||
|
||||
|
||||
Press on the Azure Key Vault tile and grant Infisical access to Azure Key Vault.
|
||||
You can optionally authenticate against a specific tenant by providing the Azure tenant or directory ID.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Obtain the Vault URI of your key vault in the Overview tab.
|
||||
|
||||
|
||||
|
||||
Select which Infisical environment secrets you want to sync to your key vault. Then, input your Vault URI from the previous step. Finally, press create integration to start syncing secrets to Azure Key Vault.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<Note>
|
||||
The Azure Key Vault integration requires the following secrets permissions to be set on the user / service principal
|
||||
for Infisical to sync secrets to Azure Key Vault: `secrets/list`, `secrets/get`, `secrets/set`, `secrets/recover`.
|
||||
|
||||
Any role with these permissions would work such as the **Key Vault Secrets Officer** role.
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Self-Hosted Setup">
|
||||
Using the Azure KV integration on a self-hosted instance of Infisical requires configuring an application in Azure
|
||||
and registering your instance with it.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an application in Azure">
|
||||
Navigate to Azure Active Directory > App registrations to create a new application.
|
||||
|
||||
<Info>
|
||||
Azure Active Directory is now Microsoft Entra ID.
|
||||
</Info>
|
||||
|
||||
|
||||
|
||||
Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/integrations/azure-key-vault/oauth2/callback`.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add your application credentials to Infisical">
|
||||
Obtain the **Application (Client) ID** in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Back in your Infisical instance, add two new environment variables for the credentials of your Azure application.
|
||||
|
||||
- `CLIENT_ID_AZURE`: The **Application (Client) ID** of your Azure application.
|
||||
- `CLIENT_SECRET_AZURE`: The **Client Secret** of your Azure application.
|
||||
|
||||
Once added, restart your Infisical instance and use the Azure KV integration.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
<Note>
|
||||
The Azure Key Vault Native Integration will be deprecated in 2026. Please migrate to our new [Azure Key Vault Sync](../secret-syncs/azure-key-vault).
|
||||
</Note>
|
||||
@@ -3,35 +3,6 @@ title: "Databricks"
|
||||
description: "Learn how to sync secrets from Infisical to Databricks."
|
||||
---
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Note>
|
||||
When integrating with Databricks, Infisical is intended to be the source of truth for the secrets in the configured Databricks scope.
|
||||
|
||||
Any secrets not present in Infisical will be removed from the specified scope. To prevent removal of secrets not managed by Infisical, Infisical recommends creating a designated secret scope for your integration.
|
||||
</Note>
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for Databricks">
|
||||
Obtain a Personal Access Token in **User Settings** > **Developer** > **Access Tokens**.
|
||||
|
||||
|
||||
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the Databricks tile and enter your Databricks instance URL in the following format: `https://xxx.cloud.databricks.com`. Then, input your Databricks Access Token to grant Infisical the necessary permissions in your Databricks account.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select which Infisical environment and secret path you want to sync to which Databricks scope. Then, press create integration to start syncing secrets to Databricks.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
The Databricks Native Integration will be deprecated in 2026. Please migrate to our new [Databricks Sync](../secret-syncs/databricks).
|
||||
</Note>
|
||||
@@ -3,138 +3,6 @@ title: "GCP Secret Manager"
|
||||
description: "How to sync secrets from Infisical to GCP Secret Manager"
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Usage">
|
||||
<AccordionGroup>
|
||||
<Accordion title="Connect with OAuth2">
|
||||
Prerequisites:
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for GCP">
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the GCP Secret Manager tile and select **Continue with OAuth**
|
||||
|
||||
|
||||
|
||||
Grant Infisical access to GCP.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
In the **Connection** tab, select which Infisical environment secrets you want to sync to which GCP secret manager project. Lastly, press create integration to start syncing secrets to GCP secret manager.
|
||||
|
||||
|
||||
|
||||
Note that the GCP Secret Manager integration supports a few options in the **Options** tab:
|
||||
|
||||
- Secret Prefix: If inputted, the prefix is appended to the front of every secret name prior to being synced.
|
||||
- Secret Suffix: If inputted, the suffix to appended to the back of every name of every secret prior to being synced.
|
||||
- Label in GCP Secret Manager: If selected, every secret will be labeled in GCP Secret Manager (e.g. as `managed-by:infisical`); labels can be customized.
|
||||
|
||||
Setting a secret prefix, suffix, or enabling the labeling option ensures that existing secrets in GCP Secret Manager are not overwritten during the sync. As part of this process, Infisical abstains from mutating any secrets in GCP Secret Manager without the specified prefix, suffix, or attached label.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<Warning>
|
||||
Using Infisical to sync secrets to GCP Secret Manager requires that you enable
|
||||
the Service Usage API and Cloud Resource Manager API in the Google Cloud project you want to sync secrets to. More on that [here](https://cloud.google.com/service-usage/docs/set-up-development-environment).
|
||||
|
||||
Additionally, ensure that your GCP account has sufficient permission to manage secret and service resources (you can assign Secret Manager Admin and Service Usage Admin roles for testing purposes)
|
||||
</Warning>
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
<Accordion title="Connect with Service Account JSON">
|
||||
Prerequisites:
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
- Have a GCP project and have/create a [service account](https://cloud.google.com/iam/docs/service-account-overview) in it
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for GCP">
|
||||
Navigate to **IAM & Admin** page in GCP and add the **Secret Manager Admin** and **Service Usage Admin** roles to the service account.
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
For enhanced security, you may want to assign more granular permissions to the service account. At minimum,
|
||||
the service account should be able to read/write secrets from/to GCP Secret Manager (e.g. **Secret Manager Admin** role)
|
||||
and list which GCP services are enabled/disabled (e.g. **Service Usage Admin** role).
|
||||
</Info>
|
||||
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the GCP Secret Manager tile and paste in your **GCP Service Account JSON** (you can create and download the JSON for your
|
||||
service account in IAM & Admin > Service Accounts > Service Account > Keys).
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
In the **Connection** tab, select which Infisical environment secrets you want to sync to the GCP secret manager project. Lastly, press create integration to start syncing secrets to GCP secret manager.
|
||||
|
||||
|
||||
|
||||
Note that the GCP Secret Manager integration supports a few options in the **Options** tab:
|
||||
|
||||
- Secret Prefix: If inputted, the prefix is appended to the front of every secret name prior to being synced.
|
||||
- Secret Suffix: If inputted, the suffix to appended to the back of every name of every secret prior to being synced.
|
||||
- Label in GCP Secret Manager: If selected, every secret will be labeled in GCP Secret Manager (e.g. as `managed-by:infisical`); labels can be customized.
|
||||
|
||||
Setting a secret prefix, suffix, or enabling the labeling option ensures that existing secrets in GCP Secret Manager are not overwritten during the sync. As part of this process, Infisical abstains from mutating any secrets in GCP Secret Manager without the specified prefix, suffix, or attached label.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<Warning>
|
||||
Using Infisical to sync secrets to GCP Secret Manager requires that you enable
|
||||
the Service Usage API and Cloud Resource Manager API in the Google Cloud project you want to sync secrets to. More on that [here](https://cloud.google.com/service-usage/docs/set-up-development-environment).
|
||||
</Warning>
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Self-Hosted Setup">
|
||||
Using the GCP Secret Manager integration (via the OAuth2 method) on a self-hosted instance of Infisical requires configuring an OAuth2 application in GCP
|
||||
and registering your instance with it.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an OAuth2 application in GCP">
|
||||
Navigate to your project API & Services > Credentials to create a new OAuth2 application.
|
||||
|
||||
|
||||
|
||||
|
||||
Create the application. As part of the form, add to **Authorized redirect URIs**: `https://your-domain.com/integrations/gcp-secret-manager/oauth2/callback`.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add your OAuth2 application credentials to Infisical">
|
||||
Obtain the **Client ID** and **Client Secret** for your GCP OAuth2 application.
|
||||
|
||||
|
||||
|
||||
Back in your Infisical instance, add two new environment variables for the credentials of your GCP OAuth2 application:
|
||||
|
||||
- `CLIENT_ID_GCP_SECRET_MANAGER`: The **Client ID** of your GCP OAuth2 application.
|
||||
- `CLIENT_SECRET_GCP_SECRET_MANAGER`: The **Client Secret** of your GCP OAuth2 application.
|
||||
|
||||
Once added, restart your Infisical instance and use the GCP Secret Manager integration.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
<Note>
|
||||
The GCP Secret Manager Native Integration will be deprecated in 2026. Please migrate to our new [GCP Secret Manager Sync](../secret-syncs/gcp-secret-manager).
|
||||
</Note>
|
||||
@@ -3,35 +3,6 @@ title: "Terraform Cloud"
|
||||
description: "How to sync secrets from Infisical to Terraform Cloud"
|
||||
---
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for Terraform Cloud">
|
||||
Obtain a Terraform Cloud API Token in User Settings > Tokens
|
||||
|
||||
|
||||
|
||||
|
||||
Obtain your Terraform Cloud Workspace Id in Projects & Workspaces > Workspace > ID
|
||||
|
||||
|
||||
|
||||
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the Terraform Cloud tile and input your Terraform Cloud API Token and Workspace Id to grant Infisical access to your Terraform Cloud account.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select which Infisical environment secrets and Terraform Cloud variable type you want to sync to which Terraform Cloud workspace/project and press create integration to start syncing secrets to Terraform Cloud.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
<Note>
|
||||
The Terraform Cloud Native Integration will be deprecated in 2026. Please migrate to our new [Terraform Cloud Sync](../secret-syncs/terraform-cloud).
|
||||
</Note>
|
||||
@@ -3,77 +3,6 @@ title: "Vercel"
|
||||
description: "How to sync secrets from Infisical to Vercel"
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Usage">
|
||||
Prerequisites:
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for Vercel">
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the Vercel tile and grant Infisical access to your Vercel account.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select which Infisical environment secrets you want to sync to which Vercel app and environment. Lastly, press create integration to start syncing secrets to Vercel.
|
||||
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
Infisical syncs every envar to Vercel with type `encrypted` unless an existing
|
||||
envar with the same name in Vercel exists with a different type. Note that
|
||||
Infisical will not be able to update Vercel envars with type `sensitive` since
|
||||
they can only be decrypted and modified by Vercel's deployment systems.
|
||||
</Info>
|
||||
|
||||
<Warning>
|
||||
The following environment variable names are reserved by Vercel and cannot be
|
||||
synced: `AWS_SECRET_KEY`, `AWS_EXECUTION_ENV`, `AWS_LAMBDA_LOG_GROUP_NAME`,
|
||||
`AWS_LAMBDA_LOG_STREAM_NAME`, `AWS_LAMBDA_FUNCTION_NAME`,
|
||||
`AWS_LAMBDA_FUNCTION_MEMORY_SIZE`, `AWS_LAMBDA_FUNCTION_VERSION`,
|
||||
`NOW_REGION`, `TZ`, `LAMBDA_TASK_ROOT`, `LAMBDA_RUNTIME_DIR`,
|
||||
`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`,
|
||||
`AWS_REGION`, and `AWS_DEFAULT_REGION`.
|
||||
</Warning>
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
<Tab title="Self-Hosted Setup">
|
||||
Using the Vercel integration on a self-hosted instance of Infisical requires configuring an integration in Vercel.
|
||||
and registering your instance with it.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an integration in Vercel">
|
||||
Navigate to Integrations > Integration Console to create a new integration.
|
||||
|
||||
|
||||
|
||||
|
||||
Create the application. As part of the form, set a **URL Slug** to a unique slug like `infisical-your-domain` and keep it handy. Also, set **Redirect URL** to `https://your-domain.com/integrations/vercel/oauth2/callback`. Lastly,
|
||||
be sure to set the API Scopes according to the second screenshot below.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add your Vercel integration credentials and information to Infisical">
|
||||
Obtain the **Client (Integration) ID** and **Client (Integration) Secret** as well as the **URL Slug** from earlier for your Vercel integration.
|
||||
|
||||
|
||||
|
||||
Back in your Infisical instance, add three new environment variables for the credentials of your Vercel integration.
|
||||
|
||||
- `CLIENT_ID_VERCEL`: The **Client (Integration) ID** of your Vercel integration.
|
||||
- `CLIENT_SECRET_VERCEL`: The **Client (Integration) Secret** of your Vercel integration.
|
||||
- `CLIENT_SLUG_VERCEL`: The **URL Slug** of your Vercel integration.
|
||||
|
||||
Once added, restart your Infisical instance and use the Vercel integration.
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
<Note>
|
||||
The Vercel Native Integration will be deprecated in 2026. Please migrate to our new [Vercel Sync](../secret-syncs/vercel).
|
||||
</Note>
|
||||
123
docs/integrations/external/backstage.mdx
vendored
Normal file
123
docs/integrations/external/backstage.mdx
vendored
Normal file
@@ -0,0 +1,123 @@
|
||||
---
|
||||
title: Backstage Infisical Plugin
|
||||
description: A powerful plugin that integrates Infisical secrets management into your Backstage developer portal.
|
||||
---
|
||||
|
||||
Integrate secrets management into your developer portal with the Backstage Infisical plugin suite. This plugin provides a seamless interface to manage your [Infisical](https://infisical.com) secrets directly within Backstage, including full support for environments and folder structure.
|
||||
|
||||
## Features
|
||||
|
||||
- **Secrets Management**: View, create, update, and delete secrets from Infisical
|
||||
- **Folder Navigation**: Explore the full folder structure of your Infisical projects
|
||||
- **Multi-Environment Support**: Easily switch between and manage different environments
|
||||
- **Entity Linking**: Map Backstage entities to specific Infisical projects via annotations
|
||||
|
||||
---
|
||||
## Installation
|
||||
|
||||
### Frontend Plugin
|
||||
|
||||
```bash
|
||||
# From your Backstage root directory
|
||||
yarn --cwd packages/app add @infisical/backstage-plugin-infisical
|
||||
```
|
||||
|
||||
### Backend Plugin
|
||||
|
||||
```bash
|
||||
# From your Backstage root directory
|
||||
yarn --cwd packages/backend add @infisical/backstage-backend-plugin-infisical
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
### Backend
|
||||
|
||||
Update your `app-config.yaml`:
|
||||
|
||||
```yaml
|
||||
infisical:
|
||||
baseUrl: https://app.infisical.com
|
||||
|
||||
authentication:
|
||||
# Option 1: API Token Authentication
|
||||
auth_token:
|
||||
token: ${INFISICAL_API_TOKEN}
|
||||
|
||||
# Option 2: Client Credentials Authentication
|
||||
universalAuth:
|
||||
clientId: ${INFISICAL_CLIENT_ID}
|
||||
clientSecret: ${INFISICAL_CLIENT_SECRET}
|
||||
```
|
||||
|
||||
<Tip>
|
||||
If you have not created a machine identity yet, you can do so in [Identities](/documentation/platform/identities/machine-identities)
|
||||
</Tip>
|
||||
|
||||
Register the plugin in `packages/backend/src/index.ts`:
|
||||
|
||||
```ts
|
||||
import { createBackend } from '@backstage/backend-defaults';
|
||||
|
||||
const backend = createBackend();
|
||||
|
||||
backend.add(import('@infisical/backstage-backend-plugin-infisical'));
|
||||
|
||||
backend.start();
|
||||
```
|
||||
|
||||
### Frontend
|
||||
|
||||
Update `packages/app/src/App.tsx` to include the plugin:
|
||||
|
||||
```tsx
|
||||
import { infisicalPlugin } from '@infisical/backstage-plugin-infisical';
|
||||
|
||||
const app = createApp({
|
||||
plugins: [
|
||||
infisicalPlugin,
|
||||
// ...other plugins
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Modify `packages/app/src/components/catalog/EntityPage.tsx`:
|
||||
|
||||
```tsx
|
||||
import { EntityInfisicalContent } from '@infisical/backstage-plugin-infisical';
|
||||
|
||||
const serviceEntityPage = (
|
||||
<EntityLayout>
|
||||
{/* ...other tabs */}
|
||||
<EntityLayout.Route path="/infisical" title="Secrets">
|
||||
<EntityInfisicalContent />
|
||||
</EntityLayout.Route>
|
||||
</EntityLayout>
|
||||
);
|
||||
```
|
||||
|
||||
### Entity Annotation
|
||||
|
||||
Add the Infisical project ID to your entity yaml settings:
|
||||
|
||||
```yaml
|
||||
apiVersion: backstage.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: example-service
|
||||
annotations:
|
||||
infisical/projectId: <your-infisical-project-id>
|
||||
```
|
||||
|
||||
> Replace `<your-infisical-project-id>` with the actual project ID from Infisical.
|
||||
|
||||
## Usage
|
||||
|
||||
Once installed and configured, you can:
|
||||
|
||||
1. **View and manage secrets** in Infisical from within Backstage
|
||||
2. **Create, update, and delete** secrets using the Infisical tab in entity pages
|
||||
3. **Navigate environments and folders**
|
||||
4. **Search and filter** secrets by key, value, or comments
|
||||
|
||||
|
||||
161
docs/integrations/secret-syncs/terraform-cloud.mdx
Normal file
161
docs/integrations/secret-syncs/terraform-cloud.mdx
Normal file
@@ -0,0 +1,161 @@
|
||||
---
|
||||
title: "Terraform Cloud Sync"
|
||||
description: "Learn how to configure a Terraform Cloud Sync for Infisical."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
|
||||
- Create a [Terraform Cloud Connection](/integrations/app-connections/terraform-cloud)
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
2. Select the **Terraform Cloud** option.
|
||||
|
||||
|
||||
3. Configure the **Source** from where secrets should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
- **Environment**: The project environment to retrieve secrets from.
|
||||
- **Secret Path**: The folder path to retrieve secrets from.
|
||||
|
||||
<Tip>
|
||||
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
|
||||
</Tip>
|
||||
|
||||
4. Configure the **Destination** to where secrets should be deployed, then click **Next**.
|
||||
|
||||
|
||||
- **Terraform Cloud Connection**: The Terraform Cloud Connection to authenticate with.
|
||||
- **Organization**: The Terraform Cloud organization to deploy secrets to.
|
||||
- **Category**: The Terraform Cloud variable category to use on secrets syncs. Choose from:
|
||||
- **Environment**: Sync secrets as environment variables.
|
||||
- **Terraform**: Sync secrets as Terraform variables.
|
||||
- **Scope**: The Terraform Cloud secret scope to sync secrets to.
|
||||
- **Variable Set**: Sync secrets to a specific variable set.
|
||||
- **Workspace**: Sync secrets to a specific workspace.
|
||||
<p class="height:1px" />
|
||||
The remaining fields are determined by the selected **Scope**:
|
||||
<AccordionGroup>
|
||||
<Accordion title="Variable Set">
|
||||
- **Variable Set**: The variable set to deploy secrets to.
|
||||
</Accordion>
|
||||
<Accordion title="Workspace">
|
||||
- **Workspace**: The workspace to deploy secrets to.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
|
||||
|
||||
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
<Note>
|
||||
Terraform Cloud does not support importing secrets.
|
||||
</Note>
|
||||
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
|
||||
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
|
||||
|
||||
6. Configure the **Details** of your Terraform Cloud Sync, then click **Next**.
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
|
||||
7. Review your Terraform Cloud Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
8. If enabled, your Terraform Cloud Sync will begin syncing your secrets to the destination endpoint.
|
||||
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an **Terraform Cloud Sync**, make an API request to the [Create Terraform Cloud Sync](/api-reference/endpoints/secret-syncs/terraform-cloud/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/secret-syncs/terraform-cloud \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-terraform-cloud-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "an example sync",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/my-secrets",
|
||||
"isEnabled": true,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"destinationConfig": {
|
||||
"scope": "variable-set",
|
||||
"variableSetId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"variableSetName": "my-variable-set",
|
||||
"org": "my-organization-id",
|
||||
"category": "env"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-terraform-cloud-sync",
|
||||
"description": "an example sync",
|
||||
"isEnabled": true,
|
||||
"version": 1,
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"syncStatus": "succeeded",
|
||||
"lastSyncJobId": "123",
|
||||
"lastSyncMessage": null,
|
||||
"lastSyncedAt": "2023-11-07T05:31:56Z",
|
||||
"importStatus": null,
|
||||
"lastImportJobId": null,
|
||||
"lastImportMessage": null,
|
||||
"lastImportedAt": null,
|
||||
"removeStatus": null,
|
||||
"lastRemoveJobId": null,
|
||||
"lastRemoveMessage": null,
|
||||
"lastRemovedAt": null,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connection": {
|
||||
"app": "terraform-cloud",
|
||||
"name": "my-terraform-cloud-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/my-secrets"
|
||||
},
|
||||
"destination": "terraform-cloud",
|
||||
"destinationConfig": {
|
||||
"scope": "workspace",
|
||||
"workspaceId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"workspaceName": "my-workspace",
|
||||
"org": "my-organization-id",
|
||||
"category": "terraform"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
@@ -424,9 +424,10 @@
|
||||
"integrations/app-connections/gcp",
|
||||
"integrations/app-connections/github",
|
||||
"integrations/app-connections/humanitec",
|
||||
"integrations/app-connections/vercel",
|
||||
"integrations/app-connections/mssql",
|
||||
"integrations/app-connections/postgres"
|
||||
"integrations/app-connections/postgres",
|
||||
"integrations/app-connections/terraform-cloud",
|
||||
"integrations/app-connections/vercel"
|
||||
]
|
||||
}
|
||||
]
|
||||
@@ -447,6 +448,7 @@
|
||||
"integrations/secret-syncs/gcp-secret-manager",
|
||||
"integrations/secret-syncs/github",
|
||||
"integrations/secret-syncs/humanitec",
|
||||
"integrations/secret-syncs/terraform-cloud",
|
||||
"integrations/secret-syncs/vercel"
|
||||
]
|
||||
}
|
||||
@@ -552,6 +554,12 @@
|
||||
"group": "Build Tool Integrations",
|
||||
"pages": ["integrations/build-tools/gradle"]
|
||||
},
|
||||
{
|
||||
"group": "Others",
|
||||
"pages": [
|
||||
"integrations/external/backstage"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "",
|
||||
"pages": ["sdks/overview"]
|
||||
@@ -1003,18 +1011,6 @@
|
||||
"api-reference/endpoints/app-connections/humanitec/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Vercel",
|
||||
"pages": [
|
||||
"api-reference/endpoints/app-connections/vercel/list",
|
||||
"api-reference/endpoints/app-connections/vercel/available",
|
||||
"api-reference/endpoints/app-connections/vercel/get-by-id",
|
||||
"api-reference/endpoints/app-connections/vercel/get-by-name",
|
||||
"api-reference/endpoints/app-connections/vercel/create",
|
||||
"api-reference/endpoints/app-connections/vercel/update",
|
||||
"api-reference/endpoints/app-connections/vercel/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Microsoft SQL Server",
|
||||
"pages": [
|
||||
@@ -1038,6 +1034,30 @@
|
||||
"api-reference/endpoints/app-connections/postgres/update",
|
||||
"api-reference/endpoints/app-connections/postgres/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Terraform Cloud",
|
||||
"pages": [
|
||||
"api-reference/endpoints/app-connections/terraform-cloud/list",
|
||||
"api-reference/endpoints/app-connections/terraform-cloud/available",
|
||||
"api-reference/endpoints/app-connections/terraform-cloud/get-by-id",
|
||||
"api-reference/endpoints/app-connections/terraform-cloud/get-by-name",
|
||||
"api-reference/endpoints/app-connections/terraform-cloud/create",
|
||||
"api-reference/endpoints/app-connections/terraform-cloud/update",
|
||||
"api-reference/endpoints/app-connections/terraform-cloud/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Vercel",
|
||||
"pages": [
|
||||
"api-reference/endpoints/app-connections/vercel/list",
|
||||
"api-reference/endpoints/app-connections/vercel/available",
|
||||
"api-reference/endpoints/app-connections/vercel/get-by-id",
|
||||
"api-reference/endpoints/app-connections/vercel/get-by-name",
|
||||
"api-reference/endpoints/app-connections/vercel/create",
|
||||
"api-reference/endpoints/app-connections/vercel/update",
|
||||
"api-reference/endpoints/app-connections/vercel/delete"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -1168,6 +1188,19 @@
|
||||
"api-reference/endpoints/secret-syncs/humanitec/remove-secrets"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Terraform Cloud",
|
||||
"pages": [
|
||||
"api-reference/endpoints/secret-syncs/terraform-cloud/list",
|
||||
"api-reference/endpoints/secret-syncs/terraform-cloud/get-by-id",
|
||||
"api-reference/endpoints/secret-syncs/terraform-cloud/get-by-name",
|
||||
"api-reference/endpoints/secret-syncs/terraform-cloud/create",
|
||||
"api-reference/endpoints/secret-syncs/terraform-cloud/update",
|
||||
"api-reference/endpoints/secret-syncs/terraform-cloud/delete",
|
||||
"api-reference/endpoints/secret-syncs/terraform-cloud/sync-secrets",
|
||||
"api-reference/endpoints/secret-syncs/terraform-cloud/remove-secrets"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Vercel",
|
||||
"pages": [
|
||||
@@ -1319,9 +1352,23 @@
|
||||
"api-reference/endpoints/kms/keys/get-by-name",
|
||||
"api-reference/endpoints/kms/keys/create",
|
||||
"api-reference/endpoints/kms/keys/update",
|
||||
"api-reference/endpoints/kms/keys/delete",
|
||||
"api-reference/endpoints/kms/keys/encrypt",
|
||||
"api-reference/endpoints/kms/keys/decrypt"
|
||||
"api-reference/endpoints/kms/keys/delete"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Encryption",
|
||||
"pages": [
|
||||
"api-reference/endpoints/kms/encryption/encrypt",
|
||||
"api-reference/endpoints/kms/encryption/decrypt"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Signing",
|
||||
"pages": [
|
||||
"api-reference/endpoints/kms/signing/sign",
|
||||
"api-reference/endpoints/kms/signing/verify",
|
||||
"api-reference/endpoints/kms/signing/public-key",
|
||||
"api-reference/endpoints/kms/signing/signing-algorithms"
|
||||
]
|
||||
}
|
||||
]
|
||||
|
||||
@@ -284,7 +284,7 @@ if err != nil {
|
||||
}
|
||||
```
|
||||
|
||||
## Working With Secrets
|
||||
## Secrets
|
||||
|
||||
### List Secrets
|
||||
|
||||
@@ -373,6 +373,9 @@ secret, err := client.Secrets().Retrieve(infisical.RetrieveSecretOptions{
|
||||
The type of the secret. Valid options are "shared" or "personal". If not
|
||||
specified, the default value is "shared".
|
||||
</ParamField>
|
||||
<ParamField query="Version" type="number" optional>
|
||||
The version of the secret to retrieve.
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
@@ -588,7 +591,7 @@ Create multiple secrets in Infisical.
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
## Working With Folders
|
||||
## Folders
|
||||
|
||||
###
|
||||
|
||||
@@ -745,3 +748,353 @@ deletedFolder, err := client.Folders().Delete(infisical.DeleteFolderOptions{
|
||||
</Expandable>
|
||||
|
||||
</ParamField>
|
||||
|
||||
## KMS
|
||||
|
||||
### Create Key
|
||||
|
||||
`client.Kms().Keys().Create(options)`
|
||||
|
||||
Create a new key in Infisical.
|
||||
|
||||
```go
|
||||
newKey, err := client.Kms().Keys().Create(infisical.KmsCreateKeyOptions{
|
||||
KeyUsage: "<sign-verify>|<encrypt-decrypt>",
|
||||
Description: "<key-description>",
|
||||
Name: "<key-name>",
|
||||
EncryptionAlgorithm: "<rsa-4096>|<ecc-nist-p256>|<aes-256-gcm>|<aes-128-gcm>",
|
||||
ProjectId: "<project-id>",
|
||||
})
|
||||
```
|
||||
|
||||
#### Parameters
|
||||
|
||||
<ParamField query="Parameters" type="object" optional>
|
||||
<Expandable title="properties">
|
||||
<ParamField query="KeyUsage" type="string" required>
|
||||
The usage of the key. Valid options are `sign-verify` or `encrypt-decrypt`.
|
||||
The usage dictates what the key can be used for.
|
||||
</ParamField>
|
||||
<ParamField query="Description" type="string" optional>
|
||||
The description of the key.
|
||||
</ParamField>
|
||||
<ParamField query="Name" type="string" required>
|
||||
The name of the key.
|
||||
</ParamField>
|
||||
<ParamField query="EncryptionAlgorithm" type="string" required>
|
||||
The encryption algorithm of the key.
|
||||
|
||||
Valid options for Signing/Verifying keys are:
|
||||
- `rsa-4096`
|
||||
- `ecc-nist-p256`
|
||||
|
||||
Valid options for Encryption/Decryption keys are:
|
||||
- `aes-256-gcm`
|
||||
- `aes-128-gcm`
|
||||
</ParamField>
|
||||
<ParamField query="ProjectId" type="string" required>
|
||||
The ID of the project where the key will be created.
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
#### Return (object)
|
||||
<ParamField query="Return" type="object">
|
||||
<Expandable title="properties">
|
||||
<ParamField query="KeyId" type="string" required>
|
||||
The ID of the key that was created.
|
||||
</ParamField>
|
||||
<ParamField query="Name" type="string" required>
|
||||
The name of the key that was created.
|
||||
</ParamField>
|
||||
<ParamField query="Description" type="string" required>
|
||||
The description of the key that was created.
|
||||
</ParamField>
|
||||
<ParamField query="IsDisabled" type="boolean" required>
|
||||
Whether or not the key is disabled.
|
||||
</ParamField>
|
||||
<ParamField query="OrgId" type="string" required>
|
||||
The ID of the organization that the key belongs to.
|
||||
</ParamField>
|
||||
<ParamField query="ProjectId" type="string" required>
|
||||
The ID of the project that the key belongs to.
|
||||
</ParamField>
|
||||
<ParamField query="KeyUsage" type="string" required>
|
||||
The intended usage of the key that was created.
|
||||
</ParamField>
|
||||
<ParamField query="EncryptionAlgorithm" type="string" required>
|
||||
The encryption algorithm of the key that was created.
|
||||
</ParamField>
|
||||
<ParamField query="Version" type="string" required>
|
||||
The version of the key that was created.
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
### Delete Key
|
||||
|
||||
`client.Kms().Keys().Delete(options)`
|
||||
|
||||
Delete a key in Infisical.
|
||||
|
||||
```go
|
||||
deletedKey, err = client.Kms().Keys().Delete(infisical.KmsDeleteKeyOptions{
|
||||
KeyId: "<key-id>",
|
||||
})
|
||||
```
|
||||
|
||||
#### Parameters
|
||||
|
||||
<ParamField query="Parameters" type="object" optional>
|
||||
<Expandable title="properties">
|
||||
<ParamField query="KeyId" type="string" required>
|
||||
The ID of the key to delete.
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
#### Return (object)
|
||||
<ParamField query="Return" type="object">
|
||||
<Expandable title="properties">
|
||||
<ParamField query="KeyId" type="string" required>
|
||||
The ID of the key that was deleted
|
||||
</ParamField>
|
||||
<ParamField query="Name" type="string" required>
|
||||
The name of the key that was deleted.
|
||||
</ParamField>
|
||||
<ParamField query="Description" type="string" required>
|
||||
The description of the key that was deleted.
|
||||
</ParamField>
|
||||
<ParamField query="IsDisabled" type="boolean" required>
|
||||
Whether or not the key is disabled.
|
||||
</ParamField>
|
||||
<ParamField query="OrgId" type="string" required>
|
||||
The ID of the organization that the key belonged to.
|
||||
</ParamField>
|
||||
<ParamField query="ProjectId" type="string" required>
|
||||
The ID of the project that the key belonged to.
|
||||
</ParamField>
|
||||
<ParamField query="KeyUsage" type="string" required>
|
||||
The intended usage of the key that was deleted.
|
||||
</ParamField>
|
||||
<ParamField query="EncryptionAlgorithm" type="string" required>
|
||||
The encryption algorithm of the key that was deleted.
|
||||
</ParamField>
|
||||
<ParamField query="Version" type="string" required>
|
||||
The version of the key that was deleted.
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
### Signing Data
|
||||
|
||||
`client.Kms().Signing().Sign(options)`
|
||||
Sign data in Infisical.
|
||||
|
||||
```go
|
||||
res, err := client.Kms().Signing().SignData(infisical.KmsSignDataOptions{
|
||||
KeyId: "<key-id>",
|
||||
Data: "<data-to-sign>", // Must be a base64 encoded string.
|
||||
SigningAlgorithm: "<signing-algorithm>", // The signing algorithm that will be used to sign the data.
|
||||
})
|
||||
```
|
||||
|
||||
#### Parameters
|
||||
|
||||
<ParamField query="Parameters" type="object" optional>
|
||||
<Expandable title="properties">
|
||||
<ParamField query="KeyId" type="string" required>
|
||||
The ID of the key to sign the data with.
|
||||
</ParamField>
|
||||
<ParamField query="Data" type="string" required>
|
||||
The data to sign. Must be a base64 encoded string.
|
||||
</ParamField>
|
||||
<ParamField query="IsDigest" type="boolean" optional>
|
||||
Whether the data is already digested or not.
|
||||
</ParamField>
|
||||
<ParamField query="SigningAlgorithm" type="string" required>
|
||||
The signing algorithm to use. You must use a signing algorithm that matches the key usage.
|
||||
|
||||
<Note>
|
||||
If you are unsure about which signing algorithms are available for your key, you can use the `client.Kms().Signing().ListSigningAlgorithms()` method. It will return an array of signing algorithms that are available for your key.
|
||||
</Note>
|
||||
|
||||
Valid options for `RSA 4096` keys are:
|
||||
- `RSASSA_PSS_SHA_512`
|
||||
- `RSASSA_PSS_SHA_384`
|
||||
- `RSASSA_PSS_SHA_256`
|
||||
- `RSASSA_PKCS1_V1_5_SHA_512`
|
||||
- `RSASSA_PKCS1_V1_5_SHA_384`
|
||||
- `RSASSA_PKCS1_V1_5_SHA_256`
|
||||
|
||||
Valid options for `ECC NIST P256` keys are:
|
||||
- `ECDSA_SHA_512`
|
||||
- `ECDSA_SHA_384`
|
||||
- `ECDSA_SHA_256`
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
#### Return ([]byte)
|
||||
<ParamField query="Return" type="[]byte">
|
||||
The signature of the data that was signed.
|
||||
</ParamField>
|
||||
|
||||
### Verifying Data
|
||||
|
||||
`client.Kms().Signing().Verify(options)`
|
||||
Verify data in Infisical.
|
||||
|
||||
```go
|
||||
res, err := client.Kms().Signing().Verify(infisical.KmsVerifyDataOptions{
|
||||
KeyId: "<key-id>",
|
||||
Data: "<data-to-verify>", // Must be a base64 encoded string.
|
||||
SigningAlgorithm: "<signing-algorithm>", // The signing algorithm that was used to sign the data.
|
||||
})
|
||||
```
|
||||
|
||||
#### Parameters
|
||||
|
||||
<ParamField query="Parameters" type="object" optional>
|
||||
<Expandable title="properties">
|
||||
<ParamField query="KeyId" type="string" required>
|
||||
The ID of the key to verify the data with.
|
||||
</ParamField>
|
||||
<ParamField query="Data" type="string" required>
|
||||
The data to verify. Must be a base64 encoded string.
|
||||
</ParamField>
|
||||
<ParamField query="IsDigest" type="boolean" optional>
|
||||
Whether the data is already digested or not.
|
||||
</ParamField>
|
||||
<ParamField query="SigningAlgorithm" type="string" required>
|
||||
The signing algorithm that was used to sign the data.
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
#### Return (object)
|
||||
<ParamField query="Return" type="object">
|
||||
<Expandable title="properties">
|
||||
<ParamField query="SignatureValid" type="boolean" required>
|
||||
Whether or not the data is valid.
|
||||
</ParamField>
|
||||
<ParamField query="KeyId" type="string" required>
|
||||
The ID of the key that was used to verify the data.
|
||||
</ParamField>
|
||||
<ParamField query="SigningAlgorithm" type="string" required>
|
||||
The signing algorithm that was used to verify the data.
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
### List Signing Algorithms
|
||||
|
||||
`client.Kms().Signing().ListSigningAlgorithms(options)`
|
||||
List signing algorithms in Infisical.
|
||||
|
||||
```go
|
||||
res, err := client.Kms().Signing().ListSigningAlgorithms(infisical.KmsListSigningAlgorithmsOptions{
|
||||
KeyId: "<key-id>",
|
||||
})
|
||||
```
|
||||
|
||||
#### Parameters
|
||||
|
||||
<ParamField query="Parameters" type="object" optional>
|
||||
<Expandable title="properties">
|
||||
<ParamField query="KeyId" type="string" required>
|
||||
The ID of the key to list signing algorithms for.
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
#### Return ([]string)
|
||||
<ParamField query="Return" type="[]string">
|
||||
The signing algorithms that are available for the key.
|
||||
</ParamField>
|
||||
|
||||
### Get Public Key
|
||||
<Note>
|
||||
This method is only available for keys with key usage `sign-verify`. If you attempt to use this method on a key that is intended for encryption/decryption, it will return an error.
|
||||
</Note>
|
||||
|
||||
`client.Kms().Signing().GetPublicKey(options)`
|
||||
Get the public key in Infisical.
|
||||
|
||||
```go
|
||||
publicKey, err := client.Kms().Signing().GetPublicKey(infisical.KmsGetPublicKeyOptions{
|
||||
KeyId: "<key-id>",
|
||||
})
|
||||
```
|
||||
|
||||
#### Parameters
|
||||
|
||||
<ParamField query="Parameters" type="object" optional>
|
||||
<Expandable title="properties">
|
||||
<ParamField query="KeyId" type="string" required>
|
||||
The ID of the key to get the public key for.
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
#### Return (string)
|
||||
<ParamField query="Return" type="string">
|
||||
The public key for the key.
|
||||
</ParamField>
|
||||
|
||||
### Encrypt Data
|
||||
|
||||
`client.Kms().Encryption().Encrypt(options)`
|
||||
Encrypt data with a key in Infisical KMS.
|
||||
|
||||
```go
|
||||
res, err := client.Kms().EncryptData(infisical.KmsEncryptDataOptions{
|
||||
KeyId: "<key-id>",
|
||||
Plaintext: "<data-to-encrypt>",
|
||||
})
|
||||
```
|
||||
|
||||
#### Parameters
|
||||
|
||||
<ParamField query="Parameters" type="object" optional>
|
||||
<Expandable title="properties">
|
||||
<ParamField query="KeyId" type="string" required>
|
||||
The ID of the key to encrypt the data with.
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
#### Return (string)
|
||||
<ParamField query="Return" type="string">
|
||||
The encrypted data.
|
||||
</ParamField>
|
||||
|
||||
### Decrypt Data
|
||||
|
||||
`client.Kms().DecryptData(options)`
|
||||
Decrypt data with a key in Infisical KMS.
|
||||
|
||||
```go
|
||||
res, err := client.Kms().DecryptData(infisical.KmsDecryptDataOptions{
|
||||
KeyId: "<key-id>",
|
||||
Ciphertext: "<encrypted-data>",
|
||||
})
|
||||
```
|
||||
|
||||
#### Parameters
|
||||
|
||||
<ParamField query="Parameters" type="object" optional>
|
||||
<Expandable title="properties">
|
||||
<ParamField query="KeyId" type="string" required>
|
||||
The ID of the key to decrypt the data with.
|
||||
</ParamField>
|
||||
<ParamField query="Ciphertext" type="string" required>
|
||||
The encrypted data to decrypt.
|
||||
</ParamField>
|
||||
</Expandable>
|
||||
</ParamField>
|
||||
|
||||
#### Return (string)
|
||||
<ParamField query="Return" type="string">
|
||||
The decrypted data.
|
||||
</ParamField>
|
||||
|
||||
@@ -34,6 +34,10 @@ Used to configure platform-specific security and operational settings
|
||||
this to `false`.
|
||||
</ParamField>
|
||||
|
||||
<ParamField query="ALLOW_INTERNAL_IP_CONNECTIONS" type="bool" default="false" optional>
|
||||
Determines whether App Connections and Dynamic Secrets are permitted to connect with internal/private IP addresses.
|
||||
</ParamField>
|
||||
|
||||
## CORS
|
||||
|
||||
Cross-Origin Resource Sharing (CORS) is a security feature that allows web applications running on one domain to access resources from another domain.
|
||||
|
||||
Reference in New Issue
Block a user