---
name: borghei-secrets-vault-manager
description: "This skill should be used when the user asks to \"generate Vault configurations\", \"plan secret rotation\", \"analyze vault audit logs\", \"manage secrets lifecycle\", or \"set up HashiCorp Vault\"."
license: "NOASSERTION"
metadata:
  decimalai-skill-id: "038f38dc-221f-4311-bcea-9ddbda072a59"
  decimalai-version-id: "5c8a4e40-d88f-4b8d-8373-a960273ada5f"
  decimalai-version: "1"
  decimalai-body-sha256: "d7abc74c0dafce99afb98ae31c4c62c1f67a9fee5b93ca81b6a5d357b87fc45e"
  decimalai-name: "borghei/secrets-vault-manager"
  decimalai-format: "1"
  decimalai-invocation: "model"
  decimalai-category: "devops"
  decimalai-source: "https://app.decimal.ai/s/borghei-secrets-vault-manager@1/SKILL.md"
---
# Secrets Vault Manager

> **Category:** Engineering
> **Domain:** Secrets Management & Security

## Overview

The **Secrets Vault Manager** skill provides tools for generating HashiCorp Vault configurations, planning and scheduling secret rotation cycles, and analyzing vault audit logs for suspicious access patterns. Essential for teams managing secrets at scale.

## Clarify First

Before generating configs or plans, confirm these inputs. If any is unknown or vague, ASK — do not assume:

- [ ] **Task** — config generation / rotation planning / audit-log analysis (selects the script and the entire workflow)
- [ ] **Environment & secrets engines** — e.g. production + kv/database/transit (`--env`, `--secrets-engines`; shapes the generated HCL)
- [ ] **Secrets inventory & classification** — Critical/High/Medium/Low per secret (drives rotation frequencies and the schedule)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact.

## Quick Start

```bash
# Generate Vault configuration
python scripts/vault_config_generator.py --env production --secrets-engines kv,database,transit

# Plan secret rotation schedule
python scripts/rotation_planner.py --inventory secrets_inventory.json

# Analyze vault audit logs
python scripts/audit_log_analyzer.py --log-file vault_audit.log --format json
```

## Tools Overview

| Tool | Purpose | Key Flags |
|------|---------|-----------|
| `vault_config_generator.py` | Generate HashiCorp Vault configurations | `--env`, `--secrets-engines`, `--auth-methods` |
| `rotation_planner.py` | Plan and schedule secret rotation cycles | `--inventory`, `--policy`, `--format` |
| `audit_log_analyzer.py` | Analyze vault audit logs for anomalies | `--log-file`, `--time-range`, `--format` |

## Workflows

### Initial Vault Setup
1. Define environment and required secrets engines
2. Run `vault_config_generator.py` to generate HCL configs
3. Review and customize generated configurations
4. Apply via Terraform or Vault CLI

### Secret Rotation Planning
1. Create secrets inventory (JSON)
2. Run `rotation_planner.py` to generate schedule
3. Review rotation plan and adjust frequencies
4. Implement automated rotation where possible

### Audit Log Investigation
1. Export vault audit logs
2. Run `audit_log_analyzer.py` for anomaly detection
3. Review flagged events
4. Investigate suspicious access patterns

## Reference Documentation

- [Secrets Management Guide](references/secrets-management-guide.md) - Best practices, rotation policies, and compliance requirements

## Common Patterns

### Secret Classification
- **Critical**: Database credentials, API master keys, encryption keys
- **High**: Service account tokens, OAuth secrets, TLS certificates
- **Medium**: Third-party API keys, webhook secrets
- **Low**: Public API keys, non-sensitive configuration