Secrets Management

Realm9 integrates with external secret vaults so that sensitive values — database passwords, API keys, certificates — never need to be stored directly in Realm9. Instead, Terraform variables reference secrets using a vault:// URI, which Realm9 resolves at provisioning time.

Path: /secrets

Secrets Management is available on all licence tiers including Free.
Access: Admins and Provisioners can manage vault connections.

---

Supported Vault Providers

---

Connecting a Vault

1. Navigate to Secrets in the sidebar
2. Click Add Vault
3. Select the vault type
4. Fill in the connection details (see per-provider fields below)
5. Optionally mark as Default Vault
6. Save — then click Test to verify connectivity

Only one vault can be marked as default per organisation. The default vault is used when resolving vault:// references.

AWS Secrets Manager

The IAM role or credentials must have: secretsmanager:GetSecretValue, secretsmanager:DescribeSecret, secretsmanager:ListSecrets.

Azure Key Vault

Without credentials, Realm9 falls back to the default Azure credential chain (managed identity, workload identity).

Required role: Key Vault Secrets User (minimum).

HashiCorp Vault / OpenBao

* Either Token or AppRole (Role ID + Secret ID) is required.

Required Vault policy:

path "secret/data/*" {
  capabilities = ["read", "list"]
}

---

Default Vault

The default vault is used to resolve all vault:// references in your organisation. Set it by toggling Default Vault when creating or editing a connection.

When no default vault is set, Terraform runs that include vault:// variable references will fail with a clear error message prompting you to configure one.

---

Using vault:// References

In Terraform workspace variables, enter a vault:// URI instead of a plain value:

vault://path/to/secret
vault://path/to/secret#key

Examples:

Realm9 resolves vault references at provisioning time — the secret value is injected into the Terraform run and is never stored in Realm9's database. Only the path is logged in the audit trail, never the value.

---

Vault Connection List

The Secrets page shows all configured vault connections. Each card displays:

• Vault name and type
• Default indicator (star icon) if this is the default vault
• Status badge: Active, Inactive, or Error
• Last tested timestamp
• Error message from the last failed test (if applicable)

Actions (Admins and Provisioners only): Test, Edit, Delete.

---

Testing a Connection

Click Test on any vault connection to verify:

• AWS: Calls ListSecrets — confirms credentials and permissions
• Azure: Lists secret properties — confirms vault URL and auth
• HashiCorp / OpenBao: Calls /v1/sys/health — confirms server is reachable, unsealed, and active; returns vault version

The test result and timestamp are saved and displayed on the card. The vault status is updated to Active on success or Error on failure.

---

Editing a Connection

Sensitive fields (secret keys, tokens, client secrets) are masked as •••••••• when editing. Leave a masked field unchanged to keep the existing value — only enter a new value to replace it. Non-sensitive fields (region, address, tenant ID, etc.) are shown in full.

---

Security

• All vault configurations are encrypted at rest using AES-256-GCM before being stored in the database
• Secret values are never stored in Realm9 — only resolved at provisioning time
• Every vault reference resolution is recorded in the audit log with the secret path (never the value)
• Sensitive fields are masked in the API response when fetching vault details for editing

---

Role-Based Access

---

Next Steps

• Automate with Terraform
• Connect Cloud Accounts
• View Audit Logs