The Secret Store is the durable, encrypted home for every secret the Secrets Manager issues or holds. It keeps each secret versioned, tracks who has leased it, and enforces which paths a caller may read via policies.
Storage profile
HashiCorp Vault fronts the secret engine; PostgreSQL is the durable backing store. Values are encrypted at rest with AES-256-GCM and never written to logs. Secrets rotate every 90d.
The schema is small and audit-oriented — secrets, their versions, outstanding leases and the policies that govern access. The ERD is embedded on the Overview tab.
SECRET.path is unique and is the lookup key callers use on
GET /secrets/{path}.SECRET_VERSION rows; exactly one is in the active
state at a time, older versions stay readable until leases expire.LEASE rows give every read a TTL so a leaked secret has a bounded blast
radius — expiry forces a re-fetch through the
Secrets Manager API.POLICY.path_glob maps a caller to the secret paths and capabilities it is
allowed.