dsg-secrets-manager-integrator

Files (4)

• README.md
• SKILL.md
• package.json
• skill.ts

SKILL.md (first lines)

# DSG Secrets Manager Integrator

Production secrets management via **AWS Secrets Manager** integration with DSG agents, credential broker, Hermes controlled executor, and deterministic governance.

***

## When to invoke this skill

| Intent                                            | Use this skill                    |
| ------------------------------------------------- | --------------------------------- |
| "Configure credential broker for Secrets Manager" | ✅ Yes — broker integration        |
| "Set up Hermes executor with secret leasing"      | ✅ Yes — controlled executor auth  |
| "Remove hardcoded secrets from environment"       | ✅ Yes — migration to vault        |
| "Rotate API keys and database passwords"          | ✅ Yes — key rotation              |
| "Audit which service accessed which secret"       | ✅ Yes — access audit trail        |
| "Test credential lease expiration"                | ✅ Yes — lease lifecycle           |
| "Create IAM policy for secret access"             | ✅ Yes — policy generation         |
| "Enable ECS task to query Secrets Manager"        | ✅ Yes — ECS integration           |
| "Quick health check on a single secret"           | ❌ Use AWS CLI or Console directly |

***

## Architecture overview

```
┌────────────────────────────────────────────────────────────┐
│                    DSG Agent / Service                      │
└─────────────────────┬──────────────────────────────────────┘
                      │
                      ▼
┌────────────────────────────────────────────────────────────┐
│              Credential Broker (Node.js)                    │
│  lib/dsg/brain/credential-broker.ts                        │
│                                                             │
│  ✓ Query Secrets Manager                                   │
│  ✓ Issue leases with expiration                            │
│  ✓ Return fingerprints (not raw secrets)                   │
│  ✓ Audit access in DynamoDB                               │
│  ✓ Support policy-based grants                            │
└─────────────────────┬──────────────────────────────────────┘
                      │
        ┌─────────────┴──────────────┬──────────────┐
        ▼                            ▼              ▼
  AWS Secrets Manager          DynamoDB         CloudTrail
  ┌─────────────────┐      (credential_leases) (audit logs)
  │ api-secrets-v2  │
  │ - API_KEY       │
  │ - JWT_SECRET    │
  │                 │
  │ db-secrets-v2   │
  │ - password      │
  │ - host          │
  │                 │
  │ oauth-secrets-v2│
  │ - client_id     │
  │ - client_secret │
  └─────────────────┘
```

***

## Secrets Manager structure

### Pre-deployment secrets (created by CDK)

```bash
# API Secrets
aws secretsmanager get-secret-value --secret-id dsg-one-dev-api-secrets-v2
# Returns: ANTHROPIC_API_KEY, JWT_SECRET, API_KEY

# Database Secrets
aws secretsmanager get-secret-value --secret-id dsg-one-dev-database-secrets-v2
# Returns: username, password, host, port, dbname

# OAuth Secrets
aws secretsmanager get-secret-value --secret-id dsg-one-dev-oauth-secrets-v2
# Returns: GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, GOOGLE_CLIENT_ID, etc.
```

### Credential broker schema (DynamoDB)

```sql
-- Table: credential_leases
CREATE TABLE credential_leases (
  id TEXT PRIMARY KEY,                          -- UUID
  secret_name TEXT NOT NULL,                    -- which secret
  secret_version TEXT,                          -- version of secret
  requester_id TEXT NOT NULL,                   -- agent/service requesting
  grant_policy_hash TEXT,                       -- hash of approval gate
  lease_issued_at TIMESTAMP NOT NULL,           -- when issued
  lease_expires_at TIMESTAMP NOT NULL,          -- when expires (15 min default)
  credential_fingerprint TEXT NOT NULL,         -- hash of secret value
  access_log_id TEXT,                           -- pointer to audit log
  status TEXT NOT NULL,                         -- ACTIVE, EXPIRED, REVOKED
  revoked_at TIMESTAMP,                         -- if revoked early
  revoke_reason TEXT
);

-- Table: credential_access_audit
CREATE TABLE credential_access_audit (
  id TEXT PRIMARY KEY,                          -- UUID
  timestamp TIMESTAMP NOT NULL,                 -- when accessed
  requester_id TEXT NOT NULL,                   -- who requested
  secret_name TEXT NOT NULL,                    -- which secret
  action TEXT NOT NULL,                         -- GET, LEASE, REVOKE
  outcome TEXT NOT NULL,                        -- SUCCESS, DENIED, EXPIRED
  denial_reason TEXT,                           -- if denied
  gate_policy_hash TEXT,                        -- governance gate used
  fingerprint_returned TEXT,                    -- fingerprint sent to requester
  request_context TEXT                         -- caller context
);
```

***

## Credential broker implementation

### Current state (Supabase-backed)

From tdealer01-crypto/tdealer01-crypto-dsg-control-plane, MIT.

More from tdealer01-crypto/tdealer01-crypto-dsg-control-plane