Organization Administration

Back Next

Secrets manager configuration

You can configure your organization to retrieve sensitive connection credentials from an external secrets manager instead of storing the credentials in the

Informatica Intelligent Cloud Services

repository. A secrets manager is also called a secret vault or a key vault.

Using a secrets manager offers the following benefits:

You retain complete control of your sensitive connection credentials like passwords, OAuth tokens, and API shared secrets.

You can manage secrets across multiple environments instead of on a per-application basis.

You can rotate secrets on your schedule without affecting your connections, mappings, or tasks in

Informatica Intelligent Cloud Services

When you enable your organization to use a secrets manager, your Secure Agents can dynamically access sensitive connection credentials from the secrets manager. You can configure one secrets manager for each organization or sub-organization.

You can use one of the following secrets managers:

AWS Secrets Manager

Azure Key Vault

HashiCorp Vault (HCP cloud-hosted)

If you use AWS Secrets Manager, the Secure Agent can access it using either role-based authentication or an access key.

Configure a secrets manager for your organization or sub-organization on the on the

Security

tab of the

Settings

page, as shown in the following image:

The Enable Secret Vault checkbox appears in the Secret Vault area of the Security tab. When you enable the checkbox, additional fields are displayed. These fields vary based on which secrets manager type you choose.

To configure your organization to use a secrets manager, you must have the Admin role or the SMS Manage Connection and SMS View Connection feature privileges as well as sufficient privileges to access the

Administrator

service. The organization must also be configured to store connection credentials on the cloud. You can't use a secrets manager if your organization stores connection credentials on a local Secure Agent.

After you configure a secrets manager for your organization, you can configure your connections to use the secrets manager. You can also choose which secrets to store and retrieve.

If you configure a secrets manager, all connections must be created and edited in

Administrator

. You can't create and edit connections when you configure mappings and tasks in

Data Integration

General and security settings

Secret names and formats

AWS Secrets Manager connection properties

Azure Key Vault connection properties

HashiCorp Vault connection properties

Enabling and disabling a secrets manager

Configuring a secrets manager for a sub-organization

Configuring a connection to use the secrets manager