be32c108819e8a860a429b613e470ad58531f0730afff64545Important: If you configure encryption for your SQL database secrets store, you should keep the encryptionKey value somewhere safe and secure, as it will always be required by the ZenML Server to decrypt the secrets in the database. If you lose the encryption key, you will not be able to decrypt the secrets anymore and will have to reset them.

Using the AWS Secrets Manager as a secrets store backend

The AWS Secrets Store uses the ZenML AWS Service Connector under the hood to authenticate with the AWS Secrets Manager API. This means that you can use any of the authentication methods supported by the AWS Service Connector to authenticate with the AWS Secrets Manager API.

"Version": "2012-10-17",

"Statement": [

"Sid": "ZenMLSecretsStore",

"Effect": "Allow",

"Action": [

"secretsmanager:CreateSecret",

"secretsmanager:GetSecretValue",

"secretsmanager:DescribeSecret",

"secretsmanager:PutSecretValue",

"secretsmanager:TagResource",

"secretsmanager:DeleteSecret"

],

"Resource": "arn:aws:secretsmanager:<AWS-region>:<AWS-account-id>:secret:zenml/*"

Example configuration for the AWS Secrets Store:

zenml:

# ...

# Secrets store settings. This is used to store centralized secrets.

secretsStore:

# Set to false to disable the secrets store.

enabled: true

# The type of the secrets store

type: aws

# Configuration for the AWS Secrets Manager secrets store

aws:

# The AWS Service Connector authentication method to use.

authMethod: secret-key

# The AWS Service Connector configuration.

authConfig:

# The AWS region to use. This must be set to the region where the AWS

# Secrets Manager service that you want to use is located.

region: us-east-1

# The AWS credentials to use to authenticate with the AWS Secrets

aws_access_key_id: <your AWS access key ID>

aws_secret_access_key: <your AWS secret access key>

Using the GCP Secrets Manager as a secrets store backend