# HashiCorp Vault Secrets & GitHub Actions: Centralized Secret Management

Managing sensitive credentials like API keys across multiple GitHub repositories is challenging. It leads to **duplicate secrets**, a lack of **versioning**, and potential **inconsistencies** between environments.

The solution is to use **HashiCorp Vault Secrets** on the HashiCorp Cloud Platform (HCP) to create a single, secure source of truth that automatically **synchronizes** secrets to your GitHub Actions workflows.

---

## Step 1: Define the Problem with a Failing Workflow

First, we establish a baseline by creating a simple GitHub Actions workflow that will **fail** because the necessary secret is missing. This mirrors the real-world issue before centralization.

### Example Workflow (`.github/workflows/vault-demo.yaml`)

This workflow is manually triggered and checks for the existence of an `AWS_API_KEY`.

YAML

```plaintext
name: Vault Demo
on:
  # Manually trigger the workflow from the GitHub UI
  workflow_dispatch: 

jobs:
  echo-vault-secret:
    runs-on: ubuntu-latest
    steps:
      - name: Verify AWS_API_KEY exists
        run: |
          # Check if the secret is empty (i.e., not found)
          if [[ -z "${{ secrets.AWS_API_KEY }}" ]]; then
            echo "::error::Secret Not Found"
            # Exit with a non-zero code to indicate failure
            exit 1 
          else
            echo "::notice::Secret Found"
          fi
```

### Purpose:

When you run this workflow, it will immediately **fail** because the `AWS_API_KEY` secret has not been defined in the repository settings.

---

## Step 2: Provision and Configure the Secret in HCP Vault

We use HashiCorp Vault Secrets on the HashiCorp Cloud Platform (HCP) to create a secure, centralized store.

### Details and Purpose:

1. **Access HCP Vault Secrets:** Log in to the HCP dashboard and select **Vault Secrets** (the fully managed service).
    
2. **Create an Application:** Create a new application (e.g., **Secret App**) within your project. This acts as a logical container for your secrets.
    
3. **Add the Secret:** Within the application, add the sensitive key-value pair.
    
    * **Key:** `AWS_API_KEY`
        
    * **Value:** `one-two-three-four-five` (Use a secure, complex value in a real scenario)
        

This action ensures that your secret is now stored centrally with **versioning** and **audit logs**.

---

## Step 3: Integrate Vault Secrets with GitHub Actions

Now we establish the automatic synchronization connection between Vault and your GitHub repository.

### Details and Purpose:

1. **Navigate to Integrations:** In the Vault Secrets console, go to **Integrations** on the left menu.
    
2. **Select GitHub Actions:** Choose the **GitHub Actions** option for integration.
    
3. **Authorize GitHub:** You will be prompted to authorize Vault's access to your GitHub account.
    
4. **Configure Sync Destination:** Select the **specific repository** (e.g., `action-one-repository`) that contains the `Vault Demo` workflow.
    
5. **Save & Sync:** Configure the sync destination and click **Save and Sync Secrets**.
    
    * **Purpose:** Vault automatically pushes the `AWS_API_KEY` secret to the target repository's secrets store. This process **synchronizes** the secret, eliminating the need to manually update it in GitHub.
        

---

## Step 4: Verify Success and Centralized Management

The final step is to confirm that the synchronization worked and that your workflow can now successfully access the secret.

### Verification:

1. **Check GitHub Secrets:** Navigate to your GitHub repository's **Settings** → **Secrets and variables** → **Actions**. The `AWS_API_KEY` secret, which was manually added by the Vault integration, should now be present.
    
2. **Rerun the Workflow:** Rerun the **Vault Demo** workflow from the GitHub Actions tab.
    

### Expected Result:

The workflow will now successfully execute. In the logs, you will see the output confirming that the secret was found:

```plaintext
::notice::Secret Found
```

**Note:** GitHub's security features ensure that the actual value of `${{` [`secrets.AWS`](http://secrets.AWS)`_API_KEY }}` is automatically masked with asterisks (`***`) in the logs, even if you try to print it.

### Key Benefits

By centralizing, you gain:

* **Single Source of Truth:** Manage secrets for all repositories from one place.
    
* **Automatic Synchronization:** Changes in Vault are instantly reflected in GitHub.
    
* **Auditability:** Vault provides a detailed log of all secret access and changes.