zero-trust-secret-vault · diff
git:20260808.52c4c5f to git:20260813.bd123bf
48 added, 0 removed. Audit A to A.
---
name: zero-trust-secret-vault
description: "Expert guide for Zero-Trust Secret Management (Infisical, HashiCorp Vault, Doppler), automated API key rotation, and environment security / Panduan ahli manajemen rahasia Zero-Trust, rotasi kunci API, dan keamanan variabel lingkungan."
author: "Roedy Rustam"
---
# Zero-Trust Secret Vault & Credential Security Expert
[English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
---
<a name="english"></a>
## English
### Purpose & Overview
Production-grade security standards for managing application secrets, environment variables, API keys, database credentials, and TLS certificates using Zero-Trust Secret Managers — Infisical, HashiCorp Vault, and Doppler — featuring automated secret rotation, dynamic credentials, and zero plain-text leaks in repositories or CI/CD pipelines.
### Key Capabilities
- **Zero Plain-Text Secrets**: Injecting encrypted secrets at runtime without storing `.env` files in production artifacts.
- **Automated Rotation**: Programmatic rotation of API keys, JWT secrets, and database passwords.
- **Audit Logging**: Tracking secret access, version history, and permission policies across development teams.
```bash
# Infisical CLI Runtime Secret Injection
infisical run -- env | grep DATABASE_URL
```
+ ### Implementation Checklist
+ - [ ] Install Infisical CLI or Vault agent in the deployment environment.
+ - [ ] Map environment variables (Development, Staging, Production) in the Secret Manager.
+ - [ ] Configure CI/CD pipeline to inject secrets dynamically rather than using `.env` files.
+ - [ ] Set up auto-rotation for database credentials and high-privilege API keys (e.g., every 30 days).
+
+ ### Example: Node.js Infisical SDK
+ ```javascript
+ import { InfisicalClient } from "@infisical/sdk";
+
+ const client = new InfisicalClient({
+ clientId: process.env.INFISICAL_CLIENT_ID,
+ clientSecret: process.env.INFISICAL_CLIENT_SECRET
+ });
+
+ const dbPassword = await client.getSecret("DATABASE_PASSWORD", {
+ environment: "prod",
+ path: "/database"
+ });
+ ```
+
+ ## Orchestration & Integration
+ - Integrates with: `ci-cd-devops-architect`, `authentication-identity-expert`, `mcp-server-architect`.
+
---
<a name="bahasa-indonesia"></a>
## Bahasa Indonesia
### Deskripsi
Standar keamanan tingkat produksi untuk pengelolaan rahasia aplikasi, variabel lingkungan, kunci API, kredensial database, dan sertifikat TLS menggunakan Secret Manager Zero-Trust — Infisical, HashiCorp Vault, dan Doppler — dengan rotasi rahasia otomatis dan jaminan tanpa kebocoran teks polos di repositori atau pipeline CI/CD.
### Fitur Utama
- **Zero Plain-Text Secrets**: Injeksi rahasia terenkripsi saat runtime tanpa menyimpan file `.env` di artefak produksi.
- **Rotasi Otomatis**: Rotasi terprogram untuk kunci API, rahasia JWT, dan kata sandi database.
- **Audit Logging**: Pelacakan akses rahasia, riwayat versi, dan kebijakan izin di seluruh tim pengembangan.
+
+ ### Checklist Implementasi
+ - [ ] Instal Infisical CLI atau agen Vault di lingkungan deployment.
+ - [ ] Petakan variabel lingkungan (Development, Staging, Production) di Secret Manager.
+ - [ ] Konfigurasi pipeline CI/CD untuk menyuntikkan rahasia secara dinamis (jangan gunakan file `.env`).
+ - [ ] Atur rotasi otomatis untuk kredensial database dan kunci API berhak istimewa (misal: setiap 30 hari).
+
+ ### Contoh: Node.js Infisical SDK
+ ```javascript
+ import { InfisicalClient } from "@infisical/sdk";
+
+ const client = new InfisicalClient({
+ clientId: process.env.INFISICAL_CLIENT_ID,
+ clientSecret: process.env.INFISICAL_CLIENT_SECRET
+ });
+
+ const dbPassword = await client.getSecret("DATABASE_PASSWORD", {
+ environment: "prod",
+ path: "/database"
+ });
+ ```
+
+ ## Integrasi Orkestrasi
+ - Terintegrasi dengan: `ci-cd-devops-architect`, `authentication-identity-expert`, `mcp-server-architect`.