zero-trust-secret-vault · diff
git:20260816.d23736e to v3.0.0
88 added, 88 removed. Audit A to A.
- ---
- name: zero-trust-secret-vault
- description: "Expert guide for Zero-Trust Secret Management (Infisical, HashiCorp Vault, Doppler), automated API key rotation, and environment security / Panduan ahli manajemen rahasia Zero-Trust, rotasi kunci API, dan keamanan variabel lingkungan."
- author: "vibes-plug-swarm"
- ---
-
- # Zero-Trust Secret Vault & Credential Security Expert
-
- [English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
-
- ---
-
- <a name="english"></a>
- ## English
-
- ### Purpose & Overview
- Production-grade security standards for managing application secrets, environment variables, API keys, database credentials, and TLS certificates using Zero-Trust Secret Managers — Infisical, HashiCorp Vault, and Doppler — featuring automated secret rotation, dynamic credentials, and zero plain-text leaks in repositories or CI/CD pipelines.
-
- ### Key Capabilities
- - **Zero Plain-Text Secrets**: Injecting encrypted secrets at runtime without storing `.env` files in production artifacts.
- - **Automated Rotation**: Programmatic rotation of API keys, JWT secrets, and database passwords.
- - **Audit Logging**: Tracking secret access, version history, and permission policies across development teams.
-
- ```bash
- # Infisical CLI Runtime Secret Injection
- infisical run -- env | grep DATABASE_URL
- ```
-
- ### Implementation Checklist
- - [ ] Install Infisical CLI or Vault agent in the deployment environment.
- - [ ] Map environment variables (Development, Staging, Production) in the Secret Manager.
- - [ ] Configure CI/CD pipeline to inject secrets dynamically rather than using `.env` files.
- - [ ] Set up auto-rotation for database credentials and high-privilege API keys (e.g., every 30 days).
-
- ### Example: Node.js Infisical SDK
- ```javascript
- import { InfisicalClient } from "@infisical/sdk";
-
- const client = new InfisicalClient({
- clientId: process.env.INFISICAL_CLIENT_ID,
- clientSecret: process.env.INFISICAL_CLIENT_SECRET
- });
-
- const dbPassword = await client.getSecret("DATABASE_PASSWORD", {
- environment: "prod",
- path: "/database"
- });
- ```
-
- ## Orchestration & Integration
- - Integrates with: `ci-cd-devops-architect`, `authentication-identity-expert`, `mcp-server-architect`.
-
- ---
-
- <a name="bahasa-indonesia"></a>
- ## Bahasa Indonesia
-
- ### Deskripsi
- Standar keamanan tingkat produksi untuk pengelolaan rahasia aplikasi, variabel lingkungan, kunci API, kredensial database, dan sertifikat TLS menggunakan Secret Manager Zero-Trust — Infisical, HashiCorp Vault, dan Doppler — dengan rotasi rahasia otomatis dan jaminan tanpa kebocoran teks polos di repositori atau pipeline CI/CD.
-
- ### Fitur Utama
- - **Zero Plain-Text Secrets**: Injeksi rahasia terenkripsi saat runtime tanpa menyimpan file `.env` di artefak produksi.
- - **Rotasi Otomatis**: Rotasi terprogram untuk kunci API, rahasia JWT, dan kata sandi database.
- - **Audit Logging**: Pelacakan akses rahasia, riwayat versi, dan kebijakan izin di seluruh tim pengembangan.
-
- ### Checklist Implementasi
- - [ ] Instal Infisical CLI atau agen Vault di lingkungan deployment.
- - [ ] Petakan variabel lingkungan (Development, Staging, Production) di Secret Manager.
- - [ ] Konfigurasi pipeline CI/CD untuk menyuntikkan rahasia secara dinamis (jangan gunakan file `.env`).
- - [ ] Atur rotasi otomatis untuk kredensial database dan kunci API berhak istimewa (misal: setiap 30 hari).
-
- ### Contoh: Node.js Infisical SDK
- ```javascript
- import { InfisicalClient } from "@infisical/sdk";
-
- const client = new InfisicalClient({
- clientId: process.env.INFISICAL_CLIENT_ID,
- clientSecret: process.env.INFISICAL_CLIENT_SECRET
- });
-
- const dbPassword = await client.getSecret("DATABASE_PASSWORD", {
- environment: "prod",
- path: "/database"
- });
- ```
-
- ## Integrasi Orkestrasi
+ ---
+ name: zero-trust-secret-vault
+ description: "Expert guide for Zero-Trust Secret Management (Infisical, HashiCorp Vault, Doppler), automated API key rotation, and environment security / Panduan ahli manajemen rahasia Zero-Trust, rotasi kunci API, dan keamanan variabel lingkungan."
+ author: "Roedy Rustam"
+ version: "3.0.0"
+ ---
+
+ # Zero-Trust Secret Vault & Credential Security Expert
+
+ [English](#english) | [Bahasa Indonesia](#bahasa-indonesia)
+
+ ---
+
+ <a name="english"></a>
+ ## English
+
+ ### Purpose & Overview
+ Production-grade security standards for managing application secrets, environment variables, API keys, database credentials, and TLS certificates using Zero-Trust Secret Managers — Infisical, HashiCorp Vault, and Doppler — featuring automated secret rotation, dynamic credentials, and zero plain-text leaks in repositories or CI/CD pipelines.
+
+ ### Key Capabilities
+ - **Zero Plain-Text Secrets**: Injecting encrypted secrets at runtime without storing `.env` files in production artifacts.
+ - **Automated Rotation**: Programmatic rotation of API keys, JWT secrets, and database passwords.
+ - **Audit Logging**: Tracking secret access, version history, and permission policies across development teams.
+
+ ```bash
+ # Infisical CLI Runtime Secret Injection
+ infisical run -- env | grep DATABASE_URL
+ ```
+
+ ### Implementation Checklist
+ - [ ] Install Infisical CLI or Vault agent in the deployment environment.
+ - [ ] Map environment variables (Development, Staging, Production) in the Secret Manager.
+ - [ ] Configure CI/CD pipeline to inject secrets dynamically rather than using `.env` files.
+ - [ ] Set up auto-rotation for database credentials and high-privilege API keys (e.g., every 30 days).
+
+ ### Example: Node.js Infisical SDK
+ ```javascript
+ import { InfisicalClient } from "@infisical/sdk";
+
+ const client = new InfisicalClient({
+ clientId: process.env.INFISICAL_CLIENT_ID,
+ clientSecret: process.env.INFISICAL_CLIENT_SECRET
+ });
+
+ const dbPassword = await client.getSecret("DATABASE_PASSWORD", {
+ environment: "prod",
+ path: "/database"
+ });
+ ```
+
+ ## Orchestration & Integration
+ - Integrates with: `ci-cd-devops-architect`, `authentication-identity-expert`, `mcp-server-architect`.
+
+ ---
+
+ <a name="bahasa-indonesia"></a>
+ ## Bahasa Indonesia
+
+ ### Deskripsi
+ Standar keamanan tingkat produksi untuk pengelolaan rahasia aplikasi, variabel lingkungan, kunci API, kredensial database, dan sertifikat TLS menggunakan Secret Manager Zero-Trust — Infisical, HashiCorp Vault, dan Doppler — dengan rotasi rahasia otomatis dan jaminan tanpa kebocoran teks polos di repositori atau pipeline CI/CD.
+
+ ### Fitur Utama
+ - **Zero Plain-Text Secrets**: Injeksi rahasia terenkripsi saat runtime tanpa menyimpan file `.env` di artefak produksi.
+ - **Rotasi Otomatis**: Rotasi terprogram untuk kunci API, rahasia JWT, dan kata sandi database.
+ - **Audit Logging**: Pelacakan akses rahasia, riwayat versi, dan kebijakan izin di seluruh tim pengembangan.
+
+ ### Checklist Implementasi
+ - [ ] Instal Infisical CLI atau agen Vault di lingkungan deployment.
+ - [ ] Petakan variabel lingkungan (Development, Staging, Production) di Secret Manager.
+ - [ ] Konfigurasi pipeline CI/CD untuk menyuntikkan rahasia secara dinamis (jangan gunakan file `.env`).
+ - [ ] Atur rotasi otomatis untuk kredensial database dan kunci API berhak istimewa (misal: setiap 30 hari).
+
+ ### Contoh: Node.js Infisical SDK
+ ```javascript
+ import { InfisicalClient } from "@infisical/sdk";
+
+ const client = new InfisicalClient({
+ clientId: process.env.INFISICAL_CLIENT_ID,
+ clientSecret: process.env.INFISICAL_CLIENT_SECRET
+ });
+
+ const dbPassword = await client.getSecret("DATABASE_PASSWORD", {
+ environment: "prod",
+ path: "/database"
+ });
+ ```
+
+ ## Integrasi Orkestrasi
- Terintegrasi dengan: `ci-cd-devops-architect`, `authentication-identity-expert`, `mcp-server-architect`.
-