mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-04 16:26:16 +00:00
merge deconflict
This commit is contained in:
Scott Wilson
@@ -56,7 +56,15 @@ Infisical supports two methods for connecting to AWS.
|
||||
|
||||
2. Select **AWS Account** as the **Trusted Entity Type**.
|
||||
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
|
||||
4. Optionally, enable **Require external ID** and enter your **Organization ID** to further enhance security.
|
||||
4. (Recommended) <strong>Enable "Require external ID"</strong> and input your **Organization ID** to strengthen security and mitigate the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html).
|
||||
|
||||
<Warning type="warning" title="Security Best Practice: Use External ID to Prevent Confused Deputy Attacks">
|
||||
When configuring an IAM Role that Infisical will assume, it’s highly recommended to enable the **"Require external ID"** option and specify your **Organization ID**.
|
||||
|
||||
This precaution helps protect your AWS account against the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html), a potential security vulnerability where Infisical could be tricked into performing actions on your behalf by an unauthorized actor.
|
||||
|
||||
<strong>Always enable "Require external ID" and use your Organization ID when setting up the IAM Role.</strong>
|
||||
</Warning>
|
||||
</Step>
|
||||
|
||||
<Step title="Add Required Permissions to the IAM Role">
|
||||
|
||||
@@ -51,6 +51,10 @@ Infisical supports connecting to Microsoft SQL Server using database principals.
|
||||
- `username` - The username of the login created in the steps above
|
||||
- `password` - The password of the login created in the steps above
|
||||
- `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
|
||||
|
||||
<Note>
|
||||
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
|
||||
@@ -41,6 +41,10 @@ Infisical supports connecting to PostgreSQL using a database role.
|
||||
- `username` - The role name of the login created in the steps above
|
||||
- `password` - The role password of the login created in the steps above
|
||||
- `sslCertificate` (optional) - The SSL certificate required for connection (if configured)
|
||||
|
||||
<Note>
|
||||
If you are self-hosting Infisical and intend to connect to an internal/private IP address, be sure to set the `ALLOW_INTERNAL_IP_CONNECTIONS` environment variable to `true`.
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
|
||||
@@ -0,0 +1,83 @@
|
||||
---
|
||||
title: "Terraform Cloud Connection"
|
||||
description: "Learn how to configure a Terraform Cloud Connection for Infisical."
|
||||
---
|
||||
|
||||
Infisical supports connecting to Terraform Cloud using a service user.
|
||||
|
||||
## Setup Terraform Cloud Connection in Infisical
|
||||
|
||||
<Steps>
|
||||
<Step title="Move to Account Settings on Terraform Cloud">
|
||||
Navigate to the Terraform Cloud **Account Settings** tab.
|
||||
|
||||
</Step>
|
||||
<Step title="Move to Tokens Tab">
|
||||
Move to the **Tokens** tab.
|
||||
|
||||
</Step>
|
||||
<Step title="Create the API Token">
|
||||
Create the API token to be used by Infisical.
|
||||
<Note>
|
||||
If you configure an expiry date for your API token you will need to manually rotate to a new token prior to expiration to avoid integration downtime.
|
||||
</Note>
|
||||
|
||||
</Step>
|
||||
<Step title="Copy the API Token">
|
||||
The API token will be displayed after creating it. Save the token in a secure location for later use in the following steps.
|
||||
|
||||
</Step>
|
||||
<Step title="Add Terraform Cloud Connection in Infisical">
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to the **App Connections** tab on the **Organization Settings** page.
|
||||
|
||||
2. Select the **Terraform Cloud Connection** option from the connection options modal.
|
||||
|
||||
3. Fill out the Terraform Cloud Connection modal, here you will need to provide the API Token generated in the previous step.
|
||||
|
||||
4. Your **Terraform Cloud Connection** is now available for use.
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an Terraform Cloud Connection, make an API request to the [Create Terraform Cloud
|
||||
Connection](/api-reference/endpoints/app-connections/terraform-cloud/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/app-connections/terraform-cloud \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-terraform-cloud-connection",
|
||||
"method": "api-token",
|
||||
"credentials": {
|
||||
"apiToken": "...",
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"appConnection": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-terraform-cloud-connection",
|
||||
"version": 123,
|
||||
"orgId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"app": "terraform-cloud",
|
||||
"method": "api-token",
|
||||
"credentials": {
|
||||
"apiToken": "..."
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
</Step>
|
||||
</Steps>
|
||||
@@ -3,197 +3,6 @@ title: "AWS Parameter Store"
|
||||
description: "Learn how to sync secrets from Infisical to AWS Parameter Store."
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Assume Role (Recommended)">
|
||||
Infisical will assume the provided role in your AWS account securely, without the need to share any credentials.
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Accordion title="Self-Hosted Users">
|
||||
To connect your Infisical instance with AWS, you need to set up an AWS IAM User account that can assume the AWS IAM Role for the integration.
|
||||
|
||||
If your instance is deployed on AWS, the aws-sdk will automatically retrieve the credentials. Ensure that you assign the provided permission policy to your deployed instance, such as ECS or EC2.
|
||||
|
||||
The following steps are for instances not deployed on AWS
|
||||
<Steps>
|
||||
<Step title="Create an IAM User">
|
||||
Navigate to [Create IAM User](https://console.aws.amazon.com/iamv2/home#/users/create) in your AWS Console.
|
||||
</Step>
|
||||
<Step title="Create an Inline Policy">
|
||||
Attach the following inline permission policy to the IAM User to allow it to assume any IAM Roles:
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowAssumeAnyRole",
|
||||
"Effect": "Allow",
|
||||
"Action": "sts:AssumeRole",
|
||||
"Resource": "arn:aws:iam::*:role/*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
</Step>
|
||||
<Step title="Obtain the IAM User Credentials">
|
||||
Obtain the AWS access key ID and secret access key for your IAM User by navigating to IAM > Users > [Your User] > Security credentials > Access keys.
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Set Up Integration Keys">
|
||||
1. Set the access key as **CLIENT_ID_AWS_INTEGRATION**.
|
||||
2. Set the secret key as **CLIENT_SECRET_AWS_INTEGRATION**.
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
|
||||
<Steps>
|
||||
<Step title="Create the Managing User IAM Role for AWS Parameter Store">
|
||||
1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console.
|
||||
|
||||
|
||||
2. Select **AWS Account** as the **Trusted Entity Type**.
|
||||
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
|
||||
4. Optionally, enable **Require external ID** and enter your **project ID** to further enhance security.
|
||||
</Step>
|
||||
|
||||
<Step title="Add Required Permissions for the IAM Role">
|
||||
|
||||
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Parameter Store:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowSSMAccess",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ssm:PutParameter",
|
||||
"ssm:DeleteParameter",
|
||||
"ssm:GetParameters",
|
||||
"ssm:GetParametersByPath",
|
||||
"ssm:DescribeParameters",
|
||||
"ssm:DeleteParameters",
|
||||
"ssm:AddTagsToResource", // if you need to add tags to secrets
|
||||
"kms:ListKeys", // if you need to specify the KMS key
|
||||
"kms:ListAliases", // if you need to specify the KMS key
|
||||
"kms:Encrypt", // if you need to specify the KMS key
|
||||
"kms:Decrypt" // if you need to specify the KMS key
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
</Step>
|
||||
|
||||
<Step title="Copy the AWS IAM Role ARN">
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Authorize Infisical for AWS Parameter Store">
|
||||
1. Navigate to your project's integrations tab in Infisical.
|
||||
2. Click on the **AWS Parameter Store** tile.
|
||||
|
||||
|
||||
3. Select the **AWS Assume Role** option.
|
||||
|
||||
|
||||
4. Provide the **AWS IAM Role ARN** obtained from the previous step and press connect.
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select which Infisical environment secrets you want to sync to which AWS Parameter Store region and indicate the path for your secrets. Then, press create integration to start syncing secrets to AWS Parameter Store.
|
||||
|
||||
|
||||
|
||||
<Tip>
|
||||
Infisical requires you to add a path for your secrets to be stored in AWS
|
||||
Parameter Store and recommends setting the path structure to
|
||||
`/[project_name]/[environment]/` according to best practices. This enables a
|
||||
secret like `TEST` to be stored as `/[project_name]/[environment]/TEST` in AWS
|
||||
Parameter Store.
|
||||
</Tip>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Access Key">
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Steps>
|
||||
<Step title="Grant the IAM user permissions to access AWS Parameter Store">
|
||||
Navigate to your IAM user permissions and add a permission policy to grant access to AWS Parameter Store.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
For enhanced security, here's a custom policy containing the minimum permissions required by Infisical to sync secrets to AWS Parameter Store for the IAM user that you can use:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowSSMAccess",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ssm:PutParameter",
|
||||
"ssm:DeleteParameter",
|
||||
"ssm:GetParameters",
|
||||
"ssm:GetParametersByPath",
|
||||
"ssm:DescribeParameters",
|
||||
"ssm:DeleteParameters",
|
||||
"ssm:AddTagsToResource", // if you need to add tags to secrets
|
||||
"kms:ListKeys", // if you need to specify the KMS key
|
||||
"kms:ListAliases", // if you need to specify the KMS key
|
||||
"kms:Encrypt", // if you need to specify the KMS key
|
||||
"kms:Decrypt" // if you need to specify the KMS key
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
</Step>
|
||||
<Step title="Authorize Infisical for AWS Parameter store">
|
||||
Obtain a AWS access key ID and secret access key for your IAM user in IAM > Users > User > Security credentials > Access keys
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the AWS Parameter Store tile and select Access Key as the authentication mode. Input your AWS access key ID and secret access key from the previous step.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select which Infisical environment secrets you want to sync to which AWS Parameter Store region and indicate the path for your secrets. Then, press create integration to start syncing secrets to AWS Parameter Store.
|
||||
|
||||
|
||||
|
||||
<Tip>
|
||||
Infisical requires you to add a path for your secrets to be stored in AWS
|
||||
Parameter Store and recommends setting the path structure to
|
||||
`/[project_name]/[environment]/` according to best practices. This enables a
|
||||
secret like `TEST` to be stored as `/[project_name]/[environment]/TEST` in AWS
|
||||
Parameter Store.
|
||||
</Tip>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
<Note>
|
||||
The AWS Parameter Store Native Integration will be deprecated in 2026. Please migrate to our new [AWS Parameter Store Sync](../secret-syncs/aws-parameter-store).
|
||||
</Note>
|
||||
@@ -3,269 +3,6 @@ title: "AWS Secrets Manager"
|
||||
description: "Learn how to sync secrets from Infisical to AWS Secrets Manager."
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Assume Role (Recommended)">
|
||||
Infisical will assume the provided role in your AWS account securely, without the need to share any credentials.
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Accordion title="Self-Hosted Users">
|
||||
To connect your Infisical instance with AWS, you need to set up an AWS IAM User account that can assume the AWS IAM Role for the integration.
|
||||
|
||||
If your instance is deployed on AWS, the aws-sdk will automatically retrieve the credentials. Ensure that you assign the provided permission policy to your deployed instance, such as ECS or EC2.
|
||||
|
||||
The following steps are for instances not deployed on AWS
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an IAM User">
|
||||
Navigate to [Create IAM User](https://console.aws.amazon.com/iamv2/home#/users/create) in your AWS Console.
|
||||
</Step>
|
||||
<Step title="Create an Inline Policy">
|
||||
Attach the following inline permission policy to the IAM User to allow it to assume any IAM Roles:
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowAssumeAnyRole",
|
||||
"Effect": "Allow",
|
||||
"Action": "sts:AssumeRole",
|
||||
"Resource": "arn:aws:iam::*:role/*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
</Step>
|
||||
<Step title="Obtain the IAM User Credentials">
|
||||
Obtain the AWS access key ID and secret access key for your IAM User by navigating to IAM > Users > [Your User] > Security credentials > Access keys.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Set Up Integration Keys">
|
||||
1. Set the access key as **CLIENT_ID_AWS_INTEGRATION**.
|
||||
2. Set the secret key as **CLIENT_SECRET_AWS_INTEGRATION**.
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
|
||||
<Steps>
|
||||
<Step title="Create the Managing User IAM Role for AWS Secrets Manager">
|
||||
1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console.
|
||||
|
||||
|
||||
2. Select **AWS Account** as the **Trusted Entity Type**.
|
||||
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
|
||||
4. Optionally, enable **Require external ID** and enter your **project ID** to further enhance security.
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Add Required Permissions for the IAM Role">
|
||||
|
||||
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowSecretsManagerAccess",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"secretsmanager:GetSecretValue",
|
||||
"secretsmanager:CreateSecret",
|
||||
"secretsmanager:UpdateSecret",
|
||||
"secretsmanager:DescribeSecret",
|
||||
"secretsmanager:TagResource",
|
||||
"secretsmanager:UntagResource",
|
||||
"kms:ListKeys",
|
||||
"kms:ListAliases",
|
||||
"kms:Encrypt",
|
||||
"kms:Decrypt"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Copy the AWS IAM Role ARN">
|
||||
|
||||
</Step>
|
||||
|
||||
<Step title="Authorize Infisical for AWS Secrets Manager">
|
||||
1. Navigate to your project's integrations tab in Infisical.
|
||||
2. Click on the **AWS Secrets Manager** tile.
|
||||
|
||||
|
||||
3. Select the **AWS Assume Role** option.
|
||||
|
||||
|
||||
4. Provide the **AWS IAM Role ARN** obtained from the previous step.
|
||||
|
||||
</Step> <Step title="Start integration">
|
||||
Select how you want to integration to work by specifying a number of parameters:
|
||||
|
||||
<ParamField path="Project Environment" type="string" required>
|
||||
The environment in Infisical from which you want to sync secrets to AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="Secrets Path" type="string" required>
|
||||
The path within the preselected environment form which you want to sync secrets to AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="AWS Region" type="string" required>
|
||||
The region that you want to integrate with in AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="Mapping Behavior" type="string" required>
|
||||
How you want the integration to map the secrets. The selected value could be either one to one or one to many.
|
||||
</ParamField>
|
||||
<ParamField path="AWS SM Secret Name" type="string" required>
|
||||
The secret name/path in AWS into which you want to sync the secrets from Infisical.
|
||||
</ParamField>
|
||||
|
||||
|
||||
|
||||
Optionally, you can add tags or specify the encryption key of all the secrets created via this integration:
|
||||
|
||||
<ParamField path="Tag Sync Mode" type="string" optional>
|
||||
The sync mode for AWS tags. The supported options are `Secret Metadata` and `Custom`. If `Secret Metadata` is selected,
|
||||
the metadata of the Infisical secrets are used as tags in AWS. If custom is selected, then the key/value of the **Secret Tag** field is used. `Secret Metadata` mode
|
||||
is only supported for one-to-one integrations.
|
||||
</ParamField>
|
||||
|
||||
<ParamField path="Secret Tag" type="string" optional>
|
||||
The Key/Value of a tag that will be added to secrets in AWS. Please note that it is possible to add multiple tags via API.
|
||||
</ParamField>
|
||||
<ParamField path="Encryption Key" type="string" optional>
|
||||
The alias/ID of the AWS KMS key used for encryption. Please note that key should be enabled in order to work and the IAM user should have access to it.
|
||||
</ParamField>
|
||||
|
||||
|
||||
Then, press `Create Integration` to start syncing secrets to AWS Secrets Manager.
|
||||
|
||||
<Info>
|
||||
Infisical currently syncs environment variables to AWS Secrets Manager as
|
||||
key-value pairs under one secret. We're actively exploring ways to help users
|
||||
group environment variable key-pairs under multiple secrets for greater
|
||||
control.
|
||||
</Info>
|
||||
<Info>
|
||||
Please note that upon deleting secrets in Infisical, AWS Secrets Manager immediately makes the secrets inaccessible but only schedules them for deletion after at least 7 days.
|
||||
</Info>
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
<Tab title="Access Key">
|
||||
Infisical will access your account using the provided AWS access key and secret key.
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
- Set up AWS and have/create an IAM user
|
||||
|
||||
<Steps>
|
||||
<Step title="Grant the IAM user permissions to access AWS Secrets Manager">
|
||||
Navigate to your IAM user permissions and add a permission policy to grant access to AWS Secrets Manager.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
For better security, here's a custom policy containing the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager for the IAM user that you can use:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "AllowSecretsManagerAccess",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"secretsmanager:GetSecretValue",
|
||||
"secretsmanager:CreateSecret",
|
||||
"secretsmanager:UpdateSecret",
|
||||
"secretsmanager:DescribeSecret", // if you need to add tags to secrets
|
||||
"secretsmanager:TagResource", // if you need to add tags to secrets
|
||||
"secretsmanager:UntagResource", // if you need to add tags to secrets
|
||||
"kms:ListKeys", // if you need to specify the KMS key
|
||||
"kms:ListAliases", // if you need to specify the KMS key
|
||||
"kms:Encrypt", // if you need to specify the KMS key
|
||||
"kms:Decrypt" // if you need to specify the KMS key
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
</Step>
|
||||
<Step title="Authorize Infisical for AWS Secrets Manager">
|
||||
Obtain a AWS access key ID and secret access key for your IAM user in IAM > Users > User > Security credentials > Access keys
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
1. Navigate to your project's integrations tab in Infisical.
|
||||
2. Click on the **AWS Secrets Manager** tile.
|
||||
|
||||
|
||||
3. Select the **Access Key** option for Authentication Mode.
|
||||
|
||||
4. Provide the **access key** and **secret key** for the AWS Iam User.
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select how you want to integration to work by specifying a number of parameters:
|
||||
|
||||
<ParamField path="Project Environment" type="string" required>
|
||||
The environment in Infisical from which you want to sync secrets to AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="Secrets Path" type="string" required>
|
||||
The path within the preselected environment form which you want to sync secrets to AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="AWS Region" type="string" required>
|
||||
The region that you want to integrate with in AWS Secrets Manager.
|
||||
</ParamField>
|
||||
<ParamField path="Mapping Behavior" type="string" required>
|
||||
How you want the integration to map the secrets. The selected value could be either one to one or one to many.
|
||||
</ParamField>
|
||||
<ParamField path="AWS SM Secret Name" type="string" required>
|
||||
The secret name/path in AWS into which you want to sync the secrets from Infisical.
|
||||
</ParamField>
|
||||
|
||||
|
||||
|
||||
Optionally, you can add tags or specify the encryption key of all the secrets created via this integration:
|
||||
|
||||
<ParamField path="Secret Tag" type="string" optional>
|
||||
The Key/Value of a tag that will be added to secrets in AWS. Please note that it is possible to add multiple tags via API.
|
||||
</ParamField>
|
||||
<ParamField path="Encryption Key" type="string" optional>
|
||||
The alias/ID of the AWS KMS key used for encryption. Please note that key should be enabled in order to work and the IAM user should have access to it.
|
||||
</ParamField>
|
||||
|
||||
|
||||
Then, press `Create Integration` to start syncing secrets to AWS Secrets Manager.
|
||||
|
||||
<Info>
|
||||
Infisical currently syncs environment variables to AWS Secrets Manager as
|
||||
key-value pairs under one secret. We're actively exploring ways to help users
|
||||
group environment variable key-pairs under multiple secrets for greater
|
||||
control.
|
||||
</Info>
|
||||
<Info>
|
||||
Please note that upon deleting secrets in Infisical, AWS Secrets Manager immediately makes the secrets inaccessible but only schedules them for deletion after at least 7 days.
|
||||
</Info>
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
<Note>
|
||||
The AWS Secrets Manager Native Integration will be deprecated in 2026. Please migrate to our new [AWS Secrets Manager Sync](../secret-syncs/aws-secrets-manager).
|
||||
</Note>
|
||||
@@ -3,110 +3,6 @@ title: "Azure App Configuration"
|
||||
description: "How to sync secrets from Infisical to Azure App Configuration"
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Usage">
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com).
|
||||
- Set up Azure and have an existing App Configuration instance.
|
||||
- User setting up the integration on Infisical must have the `App Configuration Data Owner` role for the intended Azure App Configuration instance.
|
||||
- Azure App Configuration instance must be reachable by Infisical.
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for Azure App Configuration">
|
||||
Navigate to your project's integrations tab
|
||||
|
||||
|
||||
|
||||
Press on the Azure App Configuration tile and grant Infisical access to App Configuration.
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Obtain the Azure App Configuration endpoint from the overview tab.
|
||||
|
||||
|
||||
Select which Infisical environment secrets you want to sync to your Azure App Configuration. Then, input your App Configuration instance endpoint. Optionally, you can define a prefix for your secrets which will be appended to the keys upon syncing.
|
||||
|
||||
|
||||
|
||||
Press create integration to start syncing secrets to Azure App Configuration.
|
||||
|
||||
<Warning>
|
||||
The Azure App Configuration integration requires the following permissions to be set on the user / service principal
|
||||
for Infisical to sync secrets to Azure App Configuration: `Read Key-Value`, `Write Key-Value`, `Delete Key-Value`.
|
||||
|
||||
Any role with these permissions would work such as the **App Configuration Data Owner** role. Alternatively, you can use the
|
||||
**App Configuration Data Reader** role for read-only access or **App Configuration Data Contributor** role for read/write access.
|
||||
</Warning>
|
||||
|
||||
</Step>
|
||||
<Step title="Additional Configuration">
|
||||
|
||||
#### Azure references
|
||||
When adding secrets in Infisical that reference Azure Key Vault secrets, Infisical will automatically sets the content type to `application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8` in Azure App Configuration.
|
||||
The following reference formats are automatically detected when added on Infisical's side:
|
||||
- `{ "uri": "https://my-key-vault.vault.azure.net/secrets/my-secret" }`
|
||||
- `https://my-key-vault.vault.azure.net/secrets/my-secret`
|
||||
|
||||
#### Azure Labels
|
||||
You can sync secrets from Infisical to Azure with custom labels by enabling the `Use Labels` option during setup:
|
||||
|
||||
**When enabled**: Secrets will be pushed to Azure with your specified label
|
||||
|
||||
**When disabled**: Secrets will be pushed with an empty (null) label
|
||||
|
||||
<Info>
|
||||
If you have set the initial sync to `import` have behavior, the label selection affects which secrets are imported from Azure:
|
||||
- With `Use Labels` disabled: Only secrets with empty labels are imported on initial sync
|
||||
- With `Use Labels` enabled: Only secrets matching your specified label are imported on initial sync
|
||||
</Info>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Self-Hosted Setup">
|
||||
Using the Azure App Configuration integration on a self-hosted instance of Infisical requires configuring an application in Azure
|
||||
and registering your instance with it.
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up Azure and have an existing App Configuration instance.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an application in Azure">
|
||||
Navigate to Azure Active Directory > App registrations to create a new application.
|
||||
|
||||
<Info>
|
||||
Azure Active Directory is now Microsoft Entra ID.
|
||||
</Info>
|
||||
|
||||
|
||||
|
||||
Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/integrations/azure-app-configuration/oauth2/callback`.
|
||||
<Tip>
|
||||
The domain you defined in the Redirect URI should be equivalent to the `SITE_URL` configured in your Infisical instance.
|
||||
</Tip>
|
||||
|
||||
|
||||
|
||||
After registration, set the API permissions of the app to include the following Azure App Configuration permissions: KeyValue.Delete, KeyValue.Read, and KeyValue.Write.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add your application credentials to Infisical">
|
||||
Obtain the **Application (Client) ID** in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Back in your Infisical instance, add two new environment variables for the credentials of your Azure application.
|
||||
|
||||
- `CLIENT_ID_AZURE`: The **Application (Client) ID** of your Azure application.
|
||||
- `CLIENT_SECRET_AZURE`: The **Client Secret** of your Azure application.
|
||||
|
||||
Once added, restart your Infisical instance and use the Azure App Configuration integration.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
<Note>
|
||||
The Azure App Configuration Native Integration will be deprecated in 2026. Please migrate to our new [Azure App Configuration Sync](../secret-syncs/azure-app-configuration).
|
||||
</Note>
|
||||
@@ -3,79 +3,6 @@ title: "Azure Key Vault"
|
||||
description: "How to sync secrets from Infisical to Azure Key Vault"
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Usage">
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
- Set up Azure and have an existing key vault
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for Azure Key Vault">
|
||||
Navigate to your project's integrations tab
|
||||
|
||||
|
||||
|
||||
Press on the Azure Key Vault tile and grant Infisical access to Azure Key Vault.
|
||||
You can optionally authenticate against a specific tenant by providing the Azure tenant or directory ID.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Obtain the Vault URI of your key vault in the Overview tab.
|
||||
|
||||
|
||||
|
||||
Select which Infisical environment secrets you want to sync to your key vault. Then, input your Vault URI from the previous step. Finally, press create integration to start syncing secrets to Azure Key Vault.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<Note>
|
||||
The Azure Key Vault integration requires the following secrets permissions to be set on the user / service principal
|
||||
for Infisical to sync secrets to Azure Key Vault: `secrets/list`, `secrets/get`, `secrets/set`, `secrets/recover`.
|
||||
|
||||
Any role with these permissions would work such as the **Key Vault Secrets Officer** role.
|
||||
</Note>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Self-Hosted Setup">
|
||||
Using the Azure KV integration on a self-hosted instance of Infisical requires configuring an application in Azure
|
||||
and registering your instance with it.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an application in Azure">
|
||||
Navigate to Azure Active Directory > App registrations to create a new application.
|
||||
|
||||
<Info>
|
||||
Azure Active Directory is now Microsoft Entra ID.
|
||||
</Info>
|
||||
|
||||
|
||||
|
||||
Create the application. As part of the form, set the **Redirect URI** to `https://your-domain.com/integrations/azure-key-vault/oauth2/callback`.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add your application credentials to Infisical">
|
||||
Obtain the **Application (Client) ID** in Overview and generate a **Client Secret** in Certificate & secrets for your Azure application.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Back in your Infisical instance, add two new environment variables for the credentials of your Azure application.
|
||||
|
||||
- `CLIENT_ID_AZURE`: The **Application (Client) ID** of your Azure application.
|
||||
- `CLIENT_SECRET_AZURE`: The **Client Secret** of your Azure application.
|
||||
|
||||
Once added, restart your Infisical instance and use the Azure KV integration.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
<Note>
|
||||
The Azure Key Vault Native Integration will be deprecated in 2026. Please migrate to our new [Azure Key Vault Sync](../secret-syncs/azure-key-vault).
|
||||
</Note>
|
||||
@@ -3,35 +3,6 @@ title: "Databricks"
|
||||
description: "Learn how to sync secrets from Infisical to Databricks."
|
||||
---
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Note>
|
||||
When integrating with Databricks, Infisical is intended to be the source of truth for the secrets in the configured Databricks scope.
|
||||
|
||||
Any secrets not present in Infisical will be removed from the specified scope. To prevent removal of secrets not managed by Infisical, Infisical recommends creating a designated secret scope for your integration.
|
||||
</Note>
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for Databricks">
|
||||
Obtain a Personal Access Token in **User Settings** > **Developer** > **Access Tokens**.
|
||||
|
||||
|
||||
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the Databricks tile and enter your Databricks instance URL in the following format: `https://xxx.cloud.databricks.com`. Then, input your Databricks Access Token to grant Infisical the necessary permissions in your Databricks account.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select which Infisical environment and secret path you want to sync to which Databricks scope. Then, press create integration to start syncing secrets to Databricks.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
The Databricks Native Integration will be deprecated in 2026. Please migrate to our new [Databricks Sync](../secret-syncs/databricks).
|
||||
</Note>
|
||||
@@ -3,138 +3,6 @@ title: "GCP Secret Manager"
|
||||
description: "How to sync secrets from Infisical to GCP Secret Manager"
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Usage">
|
||||
<AccordionGroup>
|
||||
<Accordion title="Connect with OAuth2">
|
||||
Prerequisites:
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for GCP">
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the GCP Secret Manager tile and select **Continue with OAuth**
|
||||
|
||||
|
||||
|
||||
Grant Infisical access to GCP.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
In the **Connection** tab, select which Infisical environment secrets you want to sync to which GCP secret manager project. Lastly, press create integration to start syncing secrets to GCP secret manager.
|
||||
|
||||
|
||||
|
||||
Note that the GCP Secret Manager integration supports a few options in the **Options** tab:
|
||||
|
||||
- Secret Prefix: If inputted, the prefix is appended to the front of every secret name prior to being synced.
|
||||
- Secret Suffix: If inputted, the suffix to appended to the back of every name of every secret prior to being synced.
|
||||
- Label in GCP Secret Manager: If selected, every secret will be labeled in GCP Secret Manager (e.g. as `managed-by:infisical`); labels can be customized.
|
||||
|
||||
Setting a secret prefix, suffix, or enabling the labeling option ensures that existing secrets in GCP Secret Manager are not overwritten during the sync. As part of this process, Infisical abstains from mutating any secrets in GCP Secret Manager without the specified prefix, suffix, or attached label.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<Warning>
|
||||
Using Infisical to sync secrets to GCP Secret Manager requires that you enable
|
||||
the Service Usage API and Cloud Resource Manager API in the Google Cloud project you want to sync secrets to. More on that [here](https://cloud.google.com/service-usage/docs/set-up-development-environment).
|
||||
|
||||
Additionally, ensure that your GCP account has sufficient permission to manage secret and service resources (you can assign Secret Manager Admin and Service Usage Admin roles for testing purposes)
|
||||
</Warning>
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
<Accordion title="Connect with Service Account JSON">
|
||||
Prerequisites:
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
- Have a GCP project and have/create a [service account](https://cloud.google.com/iam/docs/service-account-overview) in it
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for GCP">
|
||||
Navigate to **IAM & Admin** page in GCP and add the **Secret Manager Admin** and **Service Usage Admin** roles to the service account.
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
For enhanced security, you may want to assign more granular permissions to the service account. At minimum,
|
||||
the service account should be able to read/write secrets from/to GCP Secret Manager (e.g. **Secret Manager Admin** role)
|
||||
and list which GCP services are enabled/disabled (e.g. **Service Usage Admin** role).
|
||||
</Info>
|
||||
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the GCP Secret Manager tile and paste in your **GCP Service Account JSON** (you can create and download the JSON for your
|
||||
service account in IAM & Admin > Service Accounts > Service Account > Keys).
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
In the **Connection** tab, select which Infisical environment secrets you want to sync to the GCP secret manager project. Lastly, press create integration to start syncing secrets to GCP secret manager.
|
||||
|
||||
|
||||
|
||||
Note that the GCP Secret Manager integration supports a few options in the **Options** tab:
|
||||
|
||||
- Secret Prefix: If inputted, the prefix is appended to the front of every secret name prior to being synced.
|
||||
- Secret Suffix: If inputted, the suffix to appended to the back of every name of every secret prior to being synced.
|
||||
- Label in GCP Secret Manager: If selected, every secret will be labeled in GCP Secret Manager (e.g. as `managed-by:infisical`); labels can be customized.
|
||||
|
||||
Setting a secret prefix, suffix, or enabling the labeling option ensures that existing secrets in GCP Secret Manager are not overwritten during the sync. As part of this process, Infisical abstains from mutating any secrets in GCP Secret Manager without the specified prefix, suffix, or attached label.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<Warning>
|
||||
Using Infisical to sync secrets to GCP Secret Manager requires that you enable
|
||||
the Service Usage API and Cloud Resource Manager API in the Google Cloud project you want to sync secrets to. More on that [here](https://cloud.google.com/service-usage/docs/set-up-development-environment).
|
||||
</Warning>
|
||||
</Step>
|
||||
</Steps>
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Self-Hosted Setup">
|
||||
Using the GCP Secret Manager integration (via the OAuth2 method) on a self-hosted instance of Infisical requires configuring an OAuth2 application in GCP
|
||||
and registering your instance with it.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an OAuth2 application in GCP">
|
||||
Navigate to your project API & Services > Credentials to create a new OAuth2 application.
|
||||
|
||||
|
||||
|
||||
|
||||
Create the application. As part of the form, add to **Authorized redirect URIs**: `https://your-domain.com/integrations/gcp-secret-manager/oauth2/callback`.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add your OAuth2 application credentials to Infisical">
|
||||
Obtain the **Client ID** and **Client Secret** for your GCP OAuth2 application.
|
||||
|
||||
|
||||
|
||||
Back in your Infisical instance, add two new environment variables for the credentials of your GCP OAuth2 application:
|
||||
|
||||
- `CLIENT_ID_GCP_SECRET_MANAGER`: The **Client ID** of your GCP OAuth2 application.
|
||||
- `CLIENT_SECRET_GCP_SECRET_MANAGER`: The **Client Secret** of your GCP OAuth2 application.
|
||||
|
||||
Once added, restart your Infisical instance and use the GCP Secret Manager integration.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
<Note>
|
||||
The GCP Secret Manager Native Integration will be deprecated in 2026. Please migrate to our new [GCP Secret Manager Sync](../secret-syncs/gcp-secret-manager).
|
||||
</Note>
|
||||
@@ -3,35 +3,6 @@ title: "Terraform Cloud"
|
||||
description: "How to sync secrets from Infisical to Terraform Cloud"
|
||||
---
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for Terraform Cloud">
|
||||
Obtain a Terraform Cloud API Token in User Settings > Tokens
|
||||
|
||||
|
||||
|
||||
|
||||
Obtain your Terraform Cloud Workspace Id in Projects & Workspaces > Workspace > ID
|
||||
|
||||
|
||||
|
||||
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the Terraform Cloud tile and input your Terraform Cloud API Token and Workspace Id to grant Infisical access to your Terraform Cloud account.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select which Infisical environment secrets and Terraform Cloud variable type you want to sync to which Terraform Cloud workspace/project and press create integration to start syncing secrets to Terraform Cloud.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
<Note>
|
||||
The Terraform Cloud Native Integration will be deprecated in 2026. Please migrate to our new [Terraform Cloud Sync](../secret-syncs/terraform-cloud).
|
||||
</Note>
|
||||
@@ -3,77 +3,6 @@ title: "Vercel"
|
||||
description: "How to sync secrets from Infisical to Vercel"
|
||||
---
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Usage">
|
||||
Prerequisites:
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for Vercel">
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
|
||||
|
||||
|
||||
Press on the Vercel tile and grant Infisical access to your Vercel account.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Start integration">
|
||||
Select which Infisical environment secrets you want to sync to which Vercel app and environment. Lastly, press create integration to start syncing secrets to Vercel.
|
||||
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
Infisical syncs every envar to Vercel with type `encrypted` unless an existing
|
||||
envar with the same name in Vercel exists with a different type. Note that
|
||||
Infisical will not be able to update Vercel envars with type `sensitive` since
|
||||
they can only be decrypted and modified by Vercel's deployment systems.
|
||||
</Info>
|
||||
|
||||
<Warning>
|
||||
The following environment variable names are reserved by Vercel and cannot be
|
||||
synced: `AWS_SECRET_KEY`, `AWS_EXECUTION_ENV`, `AWS_LAMBDA_LOG_GROUP_NAME`,
|
||||
`AWS_LAMBDA_LOG_STREAM_NAME`, `AWS_LAMBDA_FUNCTION_NAME`,
|
||||
`AWS_LAMBDA_FUNCTION_MEMORY_SIZE`, `AWS_LAMBDA_FUNCTION_VERSION`,
|
||||
`NOW_REGION`, `TZ`, `LAMBDA_TASK_ROOT`, `LAMBDA_RUNTIME_DIR`,
|
||||
`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`,
|
||||
`AWS_REGION`, and `AWS_DEFAULT_REGION`.
|
||||
</Warning>
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
<Tab title="Self-Hosted Setup">
|
||||
Using the Vercel integration on a self-hosted instance of Infisical requires configuring an integration in Vercel.
|
||||
and registering your instance with it.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create an integration in Vercel">
|
||||
Navigate to Integrations > Integration Console to create a new integration.
|
||||
|
||||
|
||||
|
||||
|
||||
Create the application. As part of the form, set a **URL Slug** to a unique slug like `infisical-your-domain` and keep it handy. Also, set **Redirect URL** to `https://your-domain.com/integrations/vercel/oauth2/callback`. Lastly,
|
||||
be sure to set the API Scopes according to the second screenshot below.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Add your Vercel integration credentials and information to Infisical">
|
||||
Obtain the **Client (Integration) ID** and **Client (Integration) Secret** as well as the **URL Slug** from earlier for your Vercel integration.
|
||||
|
||||
|
||||
|
||||
Back in your Infisical instance, add three new environment variables for the credentials of your Vercel integration.
|
||||
|
||||
- `CLIENT_ID_VERCEL`: The **Client (Integration) ID** of your Vercel integration.
|
||||
- `CLIENT_SECRET_VERCEL`: The **Client (Integration) Secret** of your Vercel integration.
|
||||
- `CLIENT_SLUG_VERCEL`: The **URL Slug** of your Vercel integration.
|
||||
|
||||
Once added, restart your Infisical instance and use the Vercel integration.
|
||||
</Step>
|
||||
</Steps>
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
<Note>
|
||||
The Vercel Native Integration will be deprecated in 2026. Please migrate to our new [Vercel Sync](../secret-syncs/vercel).
|
||||
</Note>
|
||||
+123
@@ -0,0 +1,123 @@
|
||||
---
|
||||
title: Backstage Infisical Plugin
|
||||
description: A powerful plugin that integrates Infisical secrets management into your Backstage developer portal.
|
||||
---
|
||||
|
||||
Integrate secrets management into your developer portal with the Backstage Infisical plugin suite. This plugin provides a seamless interface to manage your [Infisical](https://infisical.com) secrets directly within Backstage, including full support for environments and folder structure.
|
||||
|
||||
## Features
|
||||
|
||||
- **Secrets Management**: View, create, update, and delete secrets from Infisical
|
||||
- **Folder Navigation**: Explore the full folder structure of your Infisical projects
|
||||
- **Multi-Environment Support**: Easily switch between and manage different environments
|
||||
- **Entity Linking**: Map Backstage entities to specific Infisical projects via annotations
|
||||
|
||||
---
|
||||
## Installation
|
||||
|
||||
### Frontend Plugin
|
||||
|
||||
```bash
|
||||
# From your Backstage root directory
|
||||
yarn --cwd packages/app add @infisical/backstage-plugin-infisical
|
||||
```
|
||||
|
||||
### Backend Plugin
|
||||
|
||||
```bash
|
||||
# From your Backstage root directory
|
||||
yarn --cwd packages/backend add @infisical/backstage-backend-plugin-infisical
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
### Backend
|
||||
|
||||
Update your `app-config.yaml`:
|
||||
|
||||
```yaml
|
||||
infisical:
|
||||
baseUrl: https://app.infisical.com
|
||||
|
||||
authentication:
|
||||
# Option 1: API Token Authentication
|
||||
auth_token:
|
||||
token: ${INFISICAL_API_TOKEN}
|
||||
|
||||
# Option 2: Client Credentials Authentication
|
||||
universalAuth:
|
||||
clientId: ${INFISICAL_CLIENT_ID}
|
||||
clientSecret: ${INFISICAL_CLIENT_SECRET}
|
||||
```
|
||||
|
||||
<Tip>
|
||||
If you have not created a machine identity yet, you can do so in [Identities](/documentation/platform/identities/machine-identities)
|
||||
</Tip>
|
||||
|
||||
Register the plugin in `packages/backend/src/index.ts`:
|
||||
|
||||
```ts
|
||||
import { createBackend } from '@backstage/backend-defaults';
|
||||
|
||||
const backend = createBackend();
|
||||
|
||||
backend.add(import('@infisical/backstage-backend-plugin-infisical'));
|
||||
|
||||
backend.start();
|
||||
```
|
||||
|
||||
### Frontend
|
||||
|
||||
Update `packages/app/src/App.tsx` to include the plugin:
|
||||
|
||||
```tsx
|
||||
import { infisicalPlugin } from '@infisical/backstage-plugin-infisical';
|
||||
|
||||
const app = createApp({
|
||||
plugins: [
|
||||
infisicalPlugin,
|
||||
// ...other plugins
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Modify `packages/app/src/components/catalog/EntityPage.tsx`:
|
||||
|
||||
```tsx
|
||||
import { EntityInfisicalContent } from '@infisical/backstage-plugin-infisical';
|
||||
|
||||
const serviceEntityPage = (
|
||||
<EntityLayout>
|
||||
{/* ...other tabs */}
|
||||
<EntityLayout.Route path="/infisical" title="Secrets">
|
||||
<EntityInfisicalContent />
|
||||
</EntityLayout.Route>
|
||||
</EntityLayout>
|
||||
);
|
||||
```
|
||||
|
||||
### Entity Annotation
|
||||
|
||||
Add the Infisical project ID to your entity yaml settings:
|
||||
|
||||
```yaml
|
||||
apiVersion: backstage.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: example-service
|
||||
annotations:
|
||||
infisical/projectId: <your-infisical-project-id>
|
||||
```
|
||||
|
||||
> Replace `<your-infisical-project-id>` with the actual project ID from Infisical.
|
||||
|
||||
## Usage
|
||||
|
||||
Once installed and configured, you can:
|
||||
|
||||
1. **View and manage secrets** in Infisical from within Backstage
|
||||
2. **Create, update, and delete** secrets using the Infisical tab in entity pages
|
||||
3. **Navigate environments and folders**
|
||||
4. **Search and filter** secrets by key, value, or comments
|
||||
|
||||
|
||||
@@ -0,0 +1,161 @@
|
||||
---
|
||||
title: "Terraform Cloud Sync"
|
||||
description: "Learn how to configure a Terraform Cloud Sync for Infisical."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
|
||||
- Create a [Terraform Cloud Connection](/integrations/app-connections/terraform-cloud)
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
2. Select the **Terraform Cloud** option.
|
||||
|
||||
|
||||
3. Configure the **Source** from where secrets should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
- **Environment**: The project environment to retrieve secrets from.
|
||||
- **Secret Path**: The folder path to retrieve secrets from.
|
||||
|
||||
<Tip>
|
||||
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
|
||||
</Tip>
|
||||
|
||||
4. Configure the **Destination** to where secrets should be deployed, then click **Next**.
|
||||
|
||||
|
||||
- **Terraform Cloud Connection**: The Terraform Cloud Connection to authenticate with.
|
||||
- **Organization**: The Terraform Cloud organization to deploy secrets to.
|
||||
- **Category**: The Terraform Cloud variable category to use on secrets syncs. Choose from:
|
||||
- **Environment**: Sync secrets as environment variables.
|
||||
- **Terraform**: Sync secrets as Terraform variables.
|
||||
- **Scope**: The Terraform Cloud secret scope to sync secrets to.
|
||||
- **Variable Set**: Sync secrets to a specific variable set.
|
||||
- **Workspace**: Sync secrets to a specific workspace.
|
||||
<p class="height:1px" />
|
||||
The remaining fields are determined by the selected **Scope**:
|
||||
<AccordionGroup>
|
||||
<Accordion title="Variable Set">
|
||||
- **Variable Set**: The variable set to deploy secrets to.
|
||||
</Accordion>
|
||||
<Accordion title="Workspace">
|
||||
- **Workspace**: The workspace to deploy secrets to.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
|
||||
|
||||
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
<Note>
|
||||
Terraform Cloud does not support importing secrets.
|
||||
</Note>
|
||||
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
|
||||
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
|
||||
|
||||
6. Configure the **Details** of your Terraform Cloud Sync, then click **Next**.
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
|
||||
7. Review your Terraform Cloud Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
8. If enabled, your Terraform Cloud Sync will begin syncing your secrets to the destination endpoint.
|
||||
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an **Terraform Cloud Sync**, make an API request to the [Create Terraform Cloud Sync](/api-reference/endpoints/secret-syncs/terraform-cloud/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/secret-syncs/terraform-cloud \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-terraform-cloud-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "an example sync",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/my-secrets",
|
||||
"isEnabled": true,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"destinationConfig": {
|
||||
"scope": "variable-set",
|
||||
"variableSetId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"variableSetName": "my-variable-set",
|
||||
"org": "my-organization-id",
|
||||
"category": "env"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-terraform-cloud-sync",
|
||||
"description": "an example sync",
|
||||
"isEnabled": true,
|
||||
"version": 1,
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"syncStatus": "succeeded",
|
||||
"lastSyncJobId": "123",
|
||||
"lastSyncMessage": null,
|
||||
"lastSyncedAt": "2023-11-07T05:31:56Z",
|
||||
"importStatus": null,
|
||||
"lastImportJobId": null,
|
||||
"lastImportMessage": null,
|
||||
"lastImportedAt": null,
|
||||
"removeStatus": null,
|
||||
"lastRemoveJobId": null,
|
||||
"lastRemoveMessage": null,
|
||||
"lastRemovedAt": null,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connection": {
|
||||
"app": "terraform-cloud",
|
||||
"name": "my-terraform-cloud-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/my-secrets"
|
||||
},
|
||||
"destination": "terraform-cloud",
|
||||
"destinationConfig": {
|
||||
"scope": "workspace",
|
||||
"workspaceId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"workspaceName": "my-workspace",
|
||||
"org": "my-organization-id",
|
||||
"category": "terraform"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
Reference in New Issue
Block a user