Secrets Management

With Automox Secrets Storage, you can securely store and retrieve secrets (passwords, API keys, etc.) so that you can use them to execute Worklet policies without them being stored or exposed in plain text to any user.

Learn how to add, edit, and remove secrets, and associate them with worklet policies.

Accessing Secrets Management

You can add, edit, and delete secrets from the Secrets & Keys page. In the Automox console, go to Settings at the top of the console and select Secrets & Keys. For details about keys, refer to Managing Keys.

Adding a Secret

You can add secrets to each of your zones. When you create worklet policies, you can use secrets to conceal sensitive information such as passwords or keys.

To add secrets, follow these steps:

1. From the Secrets Management page, click Add Secret.

2. Add a zone secret by entering a Secret Name and Value for the secret. These are required fields.

   • To check the value you entered, click the eye icon.

3. Optionally, you can add a description.

4. To add more secrets, click + Add Secret and repeat the previous steps.

5. Click Save Secrets.

Updating a Secret

You can update secrets in any zone you have access to. 

1. From the Secrets Management page, find the secret you want to update.

2. Click Edit.

3. You can only modify the Description or the Value. 

   • Note: It is not possible to change the Secret Name after it has been created.

4. Click Save.

Viewing Secrets

 The following information is available from the Secrets Management page.

Deleting a Secret 

Follow these steps to remove a secret from a zone. 

1. From the Secrets Management page, find the secret you want to remove.

2. Click Delete to remove the secret.

3. If the secret has no associated policies, you can delete the secret in the dialog window that appears and it is removed from the list. 

4. If the secret is associated with a policy, see Deleting Secrets Associated With a Worklet Policy.

Deleting Secrets Associated With a Worklet Policy

This section describes how to delete a secret when it is referenced within a worklet policy.

On the Secrets Management page, when a number is listed in the Associated Policies column, then the secret is associated with a worklet policy. This means that a worklet exists that uses an environmental variable in its code that references the secret. Refer to Using Secrets in a Worklet Policy.

In this scenario, there are two options to delete a secret from the Secrets Management page.

• Delete any variables from all policies that reference the secret. The policies remain intact.

• Delete any policies that reference the secret, then the secret can be deleted.

1. From the Secrets Management page, find the secret you want to remove.

2. Click Delete to remove the secret.

3. If the secret is associated with a worklet, a list of associated policies appears.
   

   

4. You must remove any association with policies before you can delete the secret. Click the name of the policy to open the policy page.

5. Go to the list of Inputs where variables reference secrets within the policy.

6. Find the variable that references the secret that you want to remove and click delete (x). Note: Make sure to update any code that uses the variable.

7. Save the policy.

8. Repeat for each policy that the secret is associated with.

9. Return to the Secrets Management page. When there are no more policies associated with the secret, the number in the Associated Policies column shows 0. 

10. Click Delete to remove the secret from the zone.

Using Secrets in a Worklet Policy

To securely use a secret within a worklet policy, you must add an environment variable that references the secret. This is done from the worklet policy page. Go to Manage > Policies to create or edit a worklet policy. 

Adding a Variable to a Worklet Policy

This describes how to add variables to a worklet policy.

1. From the Create Worklet or Edit Worklet page, go to Inputs.

2. Click Add Input.

3. Enter a name in the Variable Name field to associate the secret with. 

   • The variable name must contain at least 3 characters, must start with a letter, and only use alphanumeric characters or underscores (for example, api_key_1).

4. Click the Select Zone Secret drop-down menu to select an appropriate secret that you previously created on the Secrets Management page.

5. To add more variables, click Add Input.

6. Use the variable name(s) in the code of your worklet. This variable references the secret, but never reveals the contents.

7. Make any other required changes to the worklet and save the policy.

Editing Variables 

This describes how to edit variables that are part of a worklet policy.

1. From Manage > Policies, go to the worklet that you want to edit variables for.

2. From the list of Inputs, find the variable that you want to edit.

3. You can edit the Variable Name, as needed.

   • If you edit the variable name, ensure that the use of the variable in the code matches any changes that were made.

4. You can change the secret from the Select Zone Secret drop-down menu. 

   • If you do not see the secret you want to use, you must create it from the Secrets Management page in the same zone where the worklet policy is.

5. After making any changes, save the policy.

Mapping Variables to the Worklet Policy

The following examples show how variables can be directly or indirectly mapped in a worklet policy.

There are two ways of mapping variables into the code:

Mapping Variables Method 1:

You can reference input variables the same as any other Bash/Powershell variables by using the $ sign. For example: $CUSTOM_TOKEN 

Input selection:

Explicitly calling variables into the code using the $ sign:

Mapping Variables Method 2:

It is also possible to use environment variables indirectly. For example, the AWS cli expects environment variables with credentials to already exist. The variables will be exported to Powershell/Bash without the need to reference them directly in the script by using the $ sign. For example: $VARIABLE_NAME.

Input selection:

Explicitly calling variables into the code using the $ sign:

Indirect call to the variables:

Deleting Variables

You can remove any variables from the worklet policy list of Inputs by clicking x to delete it.

Note: If you delete a variable, ensure that it is not referenced in any script that is part of the worklet policy.

Related Topics

• Settings Overview

• Managing Keys

• Automox University: Secrets Management