mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
feature: secret sync base + aws parameter store & github
This commit is contained in:
Scott Wilson
@@ -67,7 +67,7 @@ Infisical supports two methods for connecting to AWS.
|
||||
Depending on your use case, add one or more of the following policies to your IAM Role:
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Secrets Sync">
|
||||
<Tab title="Secret Sync">
|
||||
<AccordionGroup>
|
||||
<Accordion title="AWS Secrets Manager">
|
||||
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager:
|
||||
@@ -217,7 +217,7 @@ Infisical supports two methods for connecting to AWS.
|
||||
Depending on your use case, add one or more of the following policies to your IAM Role:
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Secrets Sync">
|
||||
<Tab title="Secret Sync">
|
||||
<AccordionGroup>
|
||||
<Accordion title="AWS Secrets Manager">
|
||||
Use the following custom policy to grant the minimum permissions required by Infisical to sync secrets to AWS Secrets Manager:
|
||||
|
||||
@@ -23,7 +23,7 @@ Infisical supports two methods for connecting to GitHub.
|
||||
|
||||
|
||||
|
||||
Give the application a name, a homepage URL (your self-hosted domain i.e. `https://your-domain.com`), and a callback URL (i.e. `https://your-domain.com/app-connections/github/oauth/callback`).
|
||||
Give the application a name, a homepage URL (your self-hosted domain i.e. `https://your-domain.com`), and a callback URL (i.e. `https://your-domain.com/organization/app-connections/github/oauth/callback`).
|
||||
|
||||
|
||||
|
||||
@@ -116,7 +116,7 @@ Infisical supports two methods for connecting to GitHub.
|
||||
|
||||
|
||||
Create the OAuth application. As part of the form, set the **Homepage URL** to your self-hosted domain `https://your-domain.com`
|
||||
and the **Authorization callback URL** to `https://your-domain.com/app-connections/github/oauth/callback`.
|
||||
and the **Authorization callback URL** to `https://your-domain.com/organization/app-connections/github/oauth/callback`.
|
||||
|
||||
|
||||
|
||||
|
||||
143
docs/integrations/secret-syncs/aws-parameter-store.mdx
Normal file
143
docs/integrations/secret-syncs/aws-parameter-store.mdx
Normal file
@@ -0,0 +1,143 @@
|
||||
---
|
||||
title: "AWS Parameter Store Sync"
|
||||
description: "Learn how to configure an AWS Parameter Store Sync for Infisical."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
|
||||
- Create an [AWS Connection](/integrations/app-connections/aws) with the required **Secret Sync** permissions
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
2. Select the **AWS Parameter Store** option.
|
||||
|
||||
|
||||
3. Configure the **Source** from where secrets should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
- **Environment**: The project environment to retrieve secrets from.
|
||||
- **Secret Path**: The folder path to retrieve secrets from.
|
||||
|
||||
<Tip>
|
||||
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
|
||||
</Tip>
|
||||
|
||||
4. Configure the **Destination** to where secrets should be deployed, then click **Next**.
|
||||
|
||||
|
||||
- **AWS Connection**: The AWS Connection to authenticate with.
|
||||
- **Region**: The AWS region to deploy secrets to.
|
||||
- **Path**: The AWS Parameter Store path to deploy secrets to.
|
||||
|
||||
5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
|
||||
|
||||
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
- **Import Secrets (Prioritize Infisical)**: Imports secrets from the destination endpoint prior to syncing, prioritizing values present in Infisical if secrets conflict.
|
||||
- **Import Secrets (Prioritize Parameter Store)**: Imports secrets from the destination endpoint prior to syncing, prioritizing values present in Parameter Store if secrets conflict.
|
||||
- **Prepend Prefix**: An optional prefix to prepend to secret keys when synced.
|
||||
- **Append Suffix**: An optional suffix to append to secret keys when synced.
|
||||
- **Enabled**: If enabled, secrets will automatically be synced from the source. Disable to prevent syncing until enabled.
|
||||
|
||||
6. Configure the **Details** of your Parameter Store Sync, then click **Next**.
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
|
||||
7. Review your Parameter Store Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
8. If enabled, your Parameter Store Sync will begin syncing your secrets to the destination endpoint.
|
||||
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an **AWS Parameter Store Sync**, make an API request to the [Create AWS
|
||||
Parameter Store Sync](/api-reference/endpoints/secret-syncs/aws-parameter-store/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/secret-syncs/aws-parameter-store \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-parameter-store-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "an example sync",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/my-secrets",
|
||||
"isEnabled": true,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination",
|
||||
"prependPrefix": "INF_",
|
||||
},
|
||||
"destinationConfig": {
|
||||
"region": "us-east-1",
|
||||
"path": "/my-aws/path/"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-parameter-store-sync",
|
||||
"description": "an example sync",
|
||||
"isEnabled": true,
|
||||
"version": 1,
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"syncStatus": "succeeded",
|
||||
"lastSyncJobId": "123",
|
||||
"lastSyncMessage": null,
|
||||
"lastSyncedAt": "2023-11-07T05:31:56Z",
|
||||
"importStatus": null,
|
||||
"lastImportJobId": null,
|
||||
"lastImportMessage": null,
|
||||
"lastImportedAt": null,
|
||||
"removeStatus": null,
|
||||
"lastRemoveJobId": null,
|
||||
"lastRemoveMessage": null,
|
||||
"lastRemovedAt": null,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination",
|
||||
"prependPrefix": "INF_"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connection": {
|
||||
"app": "aws",
|
||||
"name": "my-aws-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/my-secrets"
|
||||
},
|
||||
"destination": "aws-parameter-store",
|
||||
"destinationConfig": {
|
||||
"region": "us-east-1",
|
||||
"path": "/my-aws/path/"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
166
docs/integrations/secret-syncs/github.mdx
Normal file
166
docs/integrations/secret-syncs/github.mdx
Normal file
@@ -0,0 +1,166 @@
|
||||
---
|
||||
title: "GitHub Sync"
|
||||
description: "Learn how to configure a GitHub Sync for Infisical."
|
||||
---
|
||||
|
||||
**Prerequisites:**
|
||||
|
||||
- Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
|
||||
- Create a [GitHub Connection](/integrations/app-connections/github)
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
|
||||
|
||||
|
||||
2. Select the **GitHub Store** option.
|
||||
|
||||
|
||||
3. Configure the **Source** from where secrets should be retrieved, then click **Next**.
|
||||
|
||||
|
||||
- **Environment**: The project environment to retrieve secrets from.
|
||||
- **Secret Path**: The folder path to retrieve secrets from.
|
||||
|
||||
<Tip>
|
||||
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
|
||||
</Tip>
|
||||
|
||||
4. Configure the **Destination** to where secrets should be deployed, then click **Next**.
|
||||
|
||||
|
||||
- **GitHub Connection**: The GitHub Connection to authenticate with.
|
||||
- **Scope**: The GitHub secret scope to sync secrets to.
|
||||
- **Organization**: Sync secrets to a specific organization.
|
||||
- **Repository**: Sync secrets to a specific repository.
|
||||
- **Repository Environment**: Sync secrets to a specific repository's environment.
|
||||
<p class="height:1px" />
|
||||
The remaining fields are determined by the selected **Scope**:
|
||||
<AccordionGroup>
|
||||
<Accordion title="Organization">
|
||||
- **Organization**: The organization to deploy secrets to.
|
||||
- **Visibility**: Determines which organization repositories can access deployed secrets.
|
||||
- **All Repositories**: All repositories of the organization. (Public repositories if not a Pro/Team account)
|
||||
- **Private Repositories**: All private repositories of the organization. (Requires Pro/Team account)
|
||||
- **Selected Repositories**: Only the selected Repositories.
|
||||
- **Selected Repositories**: The selected repositories if **Visibility** is set to **Selected Repositories**.
|
||||
</Accordion>
|
||||
<Accordion title="Repository">
|
||||
- **Repository**: The repository to deploy secrets to.
|
||||
</Accordion>
|
||||
<Accordion title="Repository Environment">
|
||||
- **Repository**: The repository to deploy secrets to.
|
||||
- **Environment**: The repository's environment to deploy secrets to.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
5. Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
|
||||
|
||||
|
||||
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
|
||||
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
|
||||
<Note>
|
||||
GitHub does not support importing secrets.
|
||||
</Note>
|
||||
- **Prepend Prefix**: An optional prefix to prepend to secret keys when synced.
|
||||
- **Append Suffix**: An optional suffix to append to secret keys when synced.
|
||||
- **Enabled**: If enabled, secrets will automatically be synced from the source. Disable to prevent syncing until enabled.
|
||||
|
||||
6. Configure the **Details** of your GitHub Sync, then click **Next**.
|
||||
|
||||
|
||||
- **Name**: The name of your sync. Must be slug-friendly.
|
||||
- **Description**: An optional description for your sync.
|
||||
|
||||
7. Review your GitHub Sync configuration, then click **Create Sync**.
|
||||
|
||||
|
||||
8. If enabled, your GitHub Sync will begin syncing your secrets to the destination endpoint.
|
||||
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an **GitHub Sync**, make an API request to the [Create GitHub Sync](/api-reference/endpoints/secret-syncs/github/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/secret-syncs/github \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-github-sync",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "an example sync",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/my-secrets",
|
||||
"isEnabled": true,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination",
|
||||
"prependPrefix": "INF_",
|
||||
},
|
||||
"destinationConfig": {
|
||||
"scope": "repository",
|
||||
"owner": "my-github",
|
||||
"repo: "my-repository"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretSync": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-github-sync",
|
||||
"description": "an example sync",
|
||||
"isEnabled": true,
|
||||
"version": 1,
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"syncStatus": "succeeded",
|
||||
"lastSyncJobId": "123",
|
||||
"lastSyncMessage": null,
|
||||
"lastSyncedAt": "2023-11-07T05:31:56Z",
|
||||
"importStatus": null,
|
||||
"lastImportJobId": null,
|
||||
"lastImportMessage": null,
|
||||
"lastImportedAt": null,
|
||||
"removeStatus": null,
|
||||
"lastRemoveJobId": null,
|
||||
"lastRemoveMessage": null,
|
||||
"lastRemovedAt": null,
|
||||
"syncOptions": {
|
||||
"initialSyncBehavior": "overwrite-destination",
|
||||
"prependPrefix": "INF_"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connection": {
|
||||
"app": "github",
|
||||
"name": "my-github-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/my-secrets"
|
||||
},
|
||||
"destination": "github",
|
||||
"destinationConfig": {
|
||||
"scope": "repository",
|
||||
"owner": "my-github",
|
||||
"repo: "my-repository"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
89
docs/integrations/secret-syncs/overview.mdx
Normal file
89
docs/integrations/secret-syncs/overview.mdx
Normal file
@@ -0,0 +1,89 @@
|
||||
---
|
||||
sidebarTitle: "Overview"
|
||||
description: "Learn how to sync secrets to third-party services with Infisical."
|
||||
---
|
||||
|
||||
Secret Syncs enable you to sync secrets from Infisical to third-party services using [App Connections](/integrations/app-connections/overview).
|
||||
|
||||
<Note>
|
||||
Secret Syncs will gradually replace Native Integrations as they become available. Native Integrations will be deprecated in the future, so opt for configuring a Secret Sync when available.
|
||||
</Note>
|
||||
|
||||
## Concept
|
||||
|
||||
Secret Syncs are a project-level resource used to sync secrets, via an [App Connection](/integrations/app-connections/overview), from a particular project environment and folder path (source)
|
||||
to a third-party service (destination). Changes to the source will automatically be propagated to the destination, ensuring
|
||||
your secrets are always up-to-date.
|
||||
|
||||
<br />
|
||||
|
||||
<div align="center">
|
||||
|
||||
```mermaid
|
||||
%%{init: {'flowchart': {'curve': 'linear'} } }%%
|
||||
graph LR
|
||||
A[App Connection]
|
||||
B[Secret Sync]
|
||||
C[Secret 1]
|
||||
D[Secret 2]
|
||||
E[Secret 3]
|
||||
F[Third-Party Service]
|
||||
G[Secret 1]
|
||||
H[Secret 2]
|
||||
I[Secret 3]
|
||||
J[Project Source]
|
||||
|
||||
B --> A
|
||||
C --> J
|
||||
D --> J
|
||||
E --> J
|
||||
A --> F
|
||||
F --> G
|
||||
F --> H
|
||||
F --> I
|
||||
J --> B
|
||||
|
||||
classDef default fill:#ffffff,stroke:#666,stroke-width:2px,rx:10px,color:black
|
||||
classDef connection fill:#FFF2B2,stroke:#E6C34A,stroke-width:2px,color:black,rx:15px
|
||||
classDef secret fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
|
||||
classDef sync fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px
|
||||
classDef service fill:#E6E6FF,stroke:#6B4E96,stroke-width:2px,color:black,rx:15px
|
||||
classDef project fill:#FFE6E6,stroke:#D63F3F,stroke-width:2px,color:black,rx:15px
|
||||
|
||||
class A connection
|
||||
class B sync
|
||||
class C,D,E,G,H,I secret
|
||||
class F project
|
||||
class J service
|
||||
```
|
||||
|
||||
</div>
|
||||
|
||||
## Workflow
|
||||
|
||||
Configuring a Secret Sync requires three components: a <strong>source</strong> location to retrieve secrets from,
|
||||
a <strong>destination</strong> endpoint to deploy secrets to, and <strong>configuration options</strong> to determine how your secrets
|
||||
should be synced. Follow these steps to start syncing:
|
||||
|
||||
<Note>
|
||||
For step-by-step guides on syncing to a particular third-party service, refer to the Secret Syncs section in the Navigation Bar.
|
||||
</Note>
|
||||
|
||||
1. <strong>Create App Connection:</strong> If you have not already done so, create an [App Connection](/integrations/app-connections/overview)
|
||||
via the UI or API for the third-party service you intend to sync secrets to.
|
||||
|
||||
2. <strong>Create Secret Sync:</strong> Configure a Secret Sync in the desired project by specifying the following parameters via the UI or API:
|
||||
- <strong>Source:</strong> The project environment and folder path you wish to retrieve secrets from.
|
||||
- <strong>Destination:</strong> The App Connection to utilize and the destination endpoint to deploy secrets to. These can vary between services.
|
||||
- <strong>Options:</strong> Customize how secrets should be synced. Examples include adding a suffix or prefix to your secrets, or importing secrets from the destination on the initial sync.
|
||||
|
||||
<Info>
|
||||
Some third-party services do not support importing secrets.
|
||||
</Info>
|
||||
|
||||
3. <strong>Utilize Sync:</strong> Any changes to the source location will now automatically be propagated to the destination endpoint.
|
||||
|
||||
<Note>
|
||||
Infisical is continuously expanding it's Secret Sync third-party service support. If the service you need isn't available,
|
||||
you can still use our Native Integrations in the interim, or contact us at team@infisical.com to make a request .
|
||||
</Note>
|
||||
Reference in New Issue
Block a user