Skip to content

ADR-008-secrets-management.md

Latest commit

 

History

History
39 lines (25 loc) · 1.1 KB

ADR-008-secrets-management.md

File metadata and controls

39 lines (25 loc) · 1.1 KB

ADR-008: AWS Secrets Manager + External Secrets + Backstage UI

Status: Accepted

Date: 2026-01-25

Context

Need to manage secrets securely, auditably, and with a developer-friendly interface.

Options Considered

  1. HashiCorp Vault (self-hosted)
  2. AWS Secrets Manager + External Secrets Operator
  3. Infisical (self-hosted)
  4. Sealed Secrets + Git

Decision

Adopt AWS Secrets Manager as storage, External Secrets Operator for sync, and custom Backstage plugin for UI with RBAC via Keycloak.

Rationale

  • AWS Secrets Manager: AWS-native, IAM/IRSA integration, automatic rotation, managed HA
  • External Secrets Operator: industry standard, GitOps-friendly, multiple backends
  • Backstage Plugin: centralizes developer experience, RBAC via existing Keycloak
  • Avoids operational complexity of Vault (HA, unsealing, storage backend)

Consequences

  • Custom Backstage plugin development (~2-3 weeks)
  • Additional AWS Secrets Manager cost (~$0.40/secret/month)
  • AWS dependency (mitigated: ESO supports multiple backends)

Naming Convention

helpdev/{env}/{region}/{domain}/{service}/{secret-type}