Secrets management

​

Architecture

1. KEK (in KMS) wraps/unwraps the DEKs
2. Each organisation has its own DEK
3. DEK encrypts/decrypts that organisation’s secrets
4. Secrets are stored encrypted in the database

​

Key hierarchy

​

Cryptographic specifications

​

Multi-tenant isolation

• Cryptographic isolation: Organisation A’s DEK cannot decrypt Organisation B’s secrets
• Breach containment: If one DEK is compromised, only that organisation’s secrets are affected
• No cross-tenant access: Even with database access, secrets from other organisations remain encrypted with different keys

​

Key management

• Restrict access: Only automated systems should have access to the KEK. Human access should be emergency-only.
• Never delete: Configure key deletion protection in your KMS provider.
• Backup carefully: If using environment variable provider, ensure the master key is securely backed up.
• Audit access: Enable KMS audit logging to track all key operations.

​

Configuration

​

Provider selection

​

Environment variables

​

Provider selection (required)

​

Environment variable provider (env)

​

AWS KMS provider (aws-kms)

​

Azure Key Vault provider (azure-keyvault)

​

GCP KMS provider (gcp-kms)

​

Cache settings

​

Example configurations

SECRETS_PROVIDER=aws-kms
SECRETS_AWS_KMS_KEY_ID=arn:aws:kms:us-east-1:123456789:key/12345-abcd-6789
SECRETS_AWS_KMS_REGION=us-east-1

SECRETS_PROVIDER=azure-keyvault
SECRETS_AZURE_KEYVAULT_URL=https://mycompany-vault.vault.azure.net
SECRETS_AZURE_KEYVAULT_KEY_NAME=gorules-master-key

SECRETS_PROVIDER=gcp-kms
SECRETS_GCP_KMS_KEY_NAME=projects/my-project/locations/us-east1/keyRings/my-ring/cryptoKeys/gorules-key

SECRETS_PROVIDER=env
SECRETS_MASTER_KEY=your-secure-passphrase-at-least-32-characters

​

Limits