Secret Store

The Secret Store is the durable, encrypted home for every secret the Secrets Manager issues or holds. It keeps each secret versioned, tracks who has leased it, and enforces which paths a caller may read via policies.

Storage profile

HashiCorp Vault fronts the secret engine; PostgreSQL is the durable backing store. Values are encrypted at rest with AES-256-GCM and never written to logs. Secrets rotate every 90d.

Data model

The schema is small and audit-oriented — secrets, their versions, outstanding leases and the policies that govern access. The ERD is embedded on the Overview tab.

Notes

SECRET.path is unique and is the lookup key callers use on GET /secrets/{path}.
A secret can have many SECRET_VERSION rows; exactly one is in the active state at a time, older versions stay readable until leases expire.
LEASE rows give every read a TTL so a leaked secret has a bounded blast radius — expiry forces a re-fetch through the Secrets Manager API.
POLICY.path_glob maps a caller to the secret paths and capabilities it is allowed.

Secret Store

Storage profile

HashiCorp Vault fronts the secret engine; PostgreSQL is the durable backing store. Values are encrypted at rest with AES-256-GCM and never written to logs. Secrets rotate every 90d.

Data model

The schema is small and audit-oriented — secrets, their versions, outstanding leases and the policies that govern access. The ERD is embedded on the Overview tab.

Notes

SECRET.path is unique and is the lookup key callers use on GET /secrets/{path}.
A secret can have many SECRET_VERSION rows; exactly one is in the active state at a time, older versions stay readable until leases expire.
LEASE rows give every read a TTL so a leaked secret has a bounded blast radius — expiry forces a re-fetch through the Secrets Manager API.
POLICY.path_glob maps a caller to the secret paths and capabilities it is allowed.