You can use AWS Secrets Manager for your Harness secrets.
Unlike AWS KMS, AWS Secrets Manager stores both secrets and encrypted keys. With AWS KMS, Harness stores the secret in its Harness store and retrieves the encryption keys from KMS. For information on using an AWS KMS Secrets Manager, go to Add an AWS KMS Secrets Manager.
This topic describes how to add an AWS Secret Manager in Harness.
Before you begin
- If you are adding an AWS Secrets Manager running on ROSA, you must also add an environment variable
AWS_REGIONwith the appropriate region as its value.
Permissions: Test AWS Permissions
Harness uses the same minimum IAM policies for AWS secret manager access as the AWS CLI.
The AWS account you use for the AWS Secret Manager must have the following policies at a minimum:
These policies let you list secrets which will allow you to add the Secret Manager and refer to secrets, but it will not let you read secrets values.
The following policy list enables Harness to perform all the secrets operations you might need:
Go to Using Identity-based Policies (IAM Policies) for Secret Manager in the AWS documentation.
To test use the AWS account when running aws secretsmanager list-secrets on either the Harness Delegate host or another host.
Step 1: Add a Secret Manager
This topic assumes you have a Harness Project set up. If not, go to Create Organizations and Projects.
You can add a Connector from any module in your Project in Project SETUP, or in your Organization, or Account Resources.
In Connectors, click Connector.
In Secret Managers, click AWS Secrets Manager. The AWS Secrets Manager settings appear.
For information on restrictions on names and maximum quotas, go to Quotas for AWS Secrets Manager.
Step 2: Overview
Enter a Name for your secret manager.
You can choose to update the ID or let it be the same as your secret manager's name. For more information, go to Entity Identifier Reference.
Enter a Description for your secret manager.
Enter Tags for your secret manager.
Step 3: Details
You can select the following options in Credential Type for authenticating with AWS:
- AWS Access Key.
- Assume IAM Role on Delegate.
- Assume Role Using STS on Delegate.
Option: AWS Access Key
Use your AWS IAM user login credentials.
Gather AWS - Access Key ID and AWS - Secret Access Key from the JSON for the Key Policy, or in the AWS IAM console, under Encryption keys.
For more information, go to Finding the Key ID and ARN from Amazon.
AWS-Access Key ID
Click Create or Select a Secret.
In the secret settings dialog, you can create/select a Secret and enter your AWS Access Key as it's value.
The AWS Access Key is the AWS Access Key ID for the IAM user you want to use to connect to Secret Manager.
AWS- Secret Access Key
Click Create or Select a Secret.
You can either create a new Secret with your Access Key ID's secret key as its Value or use an existing secret.
Secret Name Prefix
Enter Secret Name Prefix. All the secrets under this secret manager would have this prefix. For example,
devops will result in secrets like
devops/mysecret. The prefix is not a folder name.
Select the AWS Region for the Secret Manager.
Option: Assume IAM Role on Delegate
If you select this option, Harness will authenticate using the IAM role assigned to the AWS host running the Delegate you select. You can select a Delegate using a Delegate Selector.
Option: Assume Role Using STS on Delegate
This option uses the AWS Security Token Service (STS) feature. Typically, you use
AssumeRole within your account or for AWS cross-account access.
Enter the Amazon Resource Name (ARN) of the role that you want to assume. This role is an IAM role in the target deployment AWS account.
If the administrator of the account to which the role belongs provided you with an external ID, then enter that value.
For more information, go to How to Use an External ID When Granting Access to Your AWS Resources to a Third Party in the AWS documentation.
Assume Role Duration
Enter the AssumeRole Session Duration. Go to Session Duration in the AssumeRole AWS docs.
Step 4: Setup Delegates
In Setup Delegates, enter Selectors for specific Delegates that you want to allow to connect to this Connector.
Step 5: Test Connection
Once the Test Connection succeeds, click Finish. You can now see the Connector in Connectors.
Reference JSON secrets
Harness allows you to manage the lifecycle of your secrets independently by referencing JSON secrets in the vault.
For example, you can store a secret in vault with the following JSON.
Here are sample outputs for the respective JSONPath from the above JSON file:
test-secret (without any # key)