Secrets Vault Manager — Development

Secrets Vault Manager is a skill for setting up and managing production secret infrastructure using HashiCorp Vault, cloud secret stores (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), or hybrid architectures. It covers policy authoring, auth methods, secret rotation, dynamic secrets, audit logging, and emergency procedures, producing configuration files, policies, and operational guidance.

engineering claude-code

📂 View skill on GitHub ↗ 🚀 How to use

✨ What it does

Provides architecture decisions for Vault deployment (HA, auto-unseal, namespaces).
Includes configuration examples for AppRole, Kubernetes, and OIDC auth methods.
Covers secret engines: KV v2, Database, PKI, Transit, SSH.
Details rotation workflows for database passwords, API keys, TLS certs, and more.
Includes audit logging guidance and anomaly detection signals.
Provides emergency procedures for secret leaks and Vault seal operations.

🎯 When to use it

When standing up a new Vault cluster or migrating to a managed secret store.
When designing auth methods for services, CI runners, and human operators.
When implementing automated credential rotation for databases, API keys, or certificates.
When auditing secret access patterns for compliance (SOC 2, ISO 27001, HIPAA).
When responding to a secret leak that requires mass revocation.

🚀 How to use

Trigger by asking to set up secret management, integrate Vault, configure cloud secret stores, implement rotation, or audit secret access. Provide details like your infrastructure (Vault, AWS, Azure, GCP), secret types, and compliance requirements. Example prompts:

Set up a Vault cluster with AppRole auth for our microservices.
Implement automated rotation for our database credentials using Vault.
Audit our secret access patterns for SOC 2 compliance.

📄 Output: Configuration files (HCL, YAML), policy templates, rotation plans, and operational guidance.

📦 Add this skill to Claude Code

# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills

# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering/skills/secrets-vault-manager .claude/skills/secrets-vault-manager

Skill source: engineering/skills/secrets-vault-manager/SKILL.md

⚠️ Good to know

Requires access to the target secret infrastructure (Vault cluster, cloud accounts) and assumes familiarity with the underlying platforms.

❓ FAQ

What is the recommended deployment mode for Vault?

HA with Raft storage is recommended because it has no external dependency and built-in leader election.

How should I handle secret rotation for database passwords?

Use a dual-account swap method: rotate the inactive account's password, update the secret store, switch the application to the rotated account, then rotate the other account after a grace period.

What is the best way to authenticate CI/CD pipelines to Vault?

Use OIDC federation (e.g., GitHub Actions OIDC) to eliminate long-lived secrets in CI, as shown in the skill's CI/CD integration section.

🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.