secret-manager create

Note

This feature is not available in dbvr Community.

Synopsis¶

dbvr secret-manager create [-hV]
                           [--aws.region=<string> --aws.cloudId=<string>
                            --aws.configurationId=<string>
                            --aws.configurationName=<string>
                            [--aws.description=<string>]
                            |
                             --azure.vaultName=<string> [--azure.authType=<string>]
                             [--azure.cloudId=<string>]
                             [--azure.clientId=<string>]
                             [--azure.clientSecret=<string>]
                             [--azure.tenantId=<string>]
                             [--azure.clientCertificate=<string>]
                             --azure.globalConfiguration=<true|false>
                             [--azure.description=<string>]
                             --azure.configurationId=<string>
                             --azure.configurationName=<string>
                             |
                            --aws-basic.region=<string> [--aws-basic.authType=<string>]
                            [--aws-basic.awsAccessKey=<string>]
                            [--aws-basic.awsSecretKey=<string>]
                            [--aws-basic.awsSessionToken=<string>]
                            [--aws-basic.awsAssumeRoleName=<string>]
                            [--aws-basic.globalConfiguration=<true|false>]
                            [--aws-basic.description=<string>]
                            --aws-basic.configurationId=<string>
                             --aws-basic.configurationName=<string>
                            |
                             --cyberark.baseUrl=<string> --cyberark.account=<string>
                            --cyberark.username=<string> --cyberark.apiKey=<string>
                            --cyberark.policyBranch=<string>
                            --cyberark.configurationId=<string>
                            --cyberark.configurationName=<string>
                            [--cyberark.trustCertificate=<true|false>]
                            [--cyberark.globalConfiguration=<true|false>]
                            [--cyberark.description=<string>]
                           |
                            --gcp.project=<string> [--gcp.authType=<string>]
                            [--gcp.cloudId=<string>]
                            [--gcp.serviceAccountConfig=<string>]
                            [--gcp.globalConfiguration=<true|false>]
                            [--gcp.description=<string>]
                            --gcp.configurationId=<string>
                            --gcp.configurationName=<string>
                           |
                            --vault.vaultUrl=<string> --vault.authType=<value>
                            --vault.vaultJwtProviderId=<string>
                            --vault.token=<string> --vault.username=<string>
                            --vault.password=<string>
                            --vault.configurationId=<string>
                            --vault.configurationName=<string>
                            [--vault.vaultRoleClaim=<string>]
                            [--vault.globalConfiguration=<true|false>]
                            [--vault.description=<string>]]

Tip

You can also use global options with this command.

Description¶

Create a new secret manager configuration.

Use one of the provider-specific option groups - --aws.*, --azure.*, --aws-basic.*, --cyberark.*, --gcp.*, or --vault.* - to define the connection. All required options for the chosen provider must be specified.

Note

--aws.* configures AWS Integrated Cloud Secrets (using an existing AWS Cloud profile), while --aws-basic.* configures AWS Secrets with region and static credentials.

AWS Integrated Cloud Secrets options¶

--aws.region¶

--aws.region=<string>

AWS region where the secrets are stored.

--aws.cloudId¶

--aws.cloudId=<string>

AWS Cloud configuration ID used for authentication. Specifies which AWS Cloud profile to use to access the secrets.

--aws.configurationId¶

--aws.configurationId=<string>

Unique identifier for this configuration.

--aws.configurationName¶

--aws.configurationName=<string>

Display name for this configuration.

--aws.description¶

--aws.description=<string>

Optional description.

Azure Key Vault options¶

--azure.vaultName¶

--azure.vaultName=<string>

Name of the Azure Key Vault that stores the secrets.

--azure.authType¶

--azure.authType=<string>

Authentication type. Accepted values: Default credentials, Client certificate, Enterprise application, Client secret, Cloud Integration.

--azure.cloudId¶

--azure.cloudId=<string>

Azure Cloud configuration ID used for authentication. Used when --azure.authType="Cloud Integration".

--azure.clientId¶

--azure.clientId=<string>

Microsoft Entra ID application ID. Used with Client certificate, Enterprise application, and Client secret authentication.

--azure.clientSecret¶

--azure.clientSecret=<string>

Secret for the Microsoft Entra ID application. Used when --azure.authType="Client secret".

--azure.tenantId¶

--azure.tenantId=<string>

Microsoft Entra ID tenant ID. Used with Client certificate, Enterprise application, and Client secret authentication.

--azure.clientCertificate¶

--azure.clientCertificate=<string>

Path to the client certificate in PEM or PFX format. Files with the .pfx extension are treated as PFX; other files are treated as PEM. Used when --azure.authType="Client certificate".

--azure.configurationId¶

--azure.configurationId=<string>

Unique identifier for this configuration.

--azure.configurationName¶

--azure.configurationName=<string>

Display name for this configuration.

--azure.globalConfiguration¶

--azure.globalConfiguration=<true|false>

Apply this configuration globally across all clients.

--azure.description¶

--azure.description=<string>

Optional description.

AWS Secrets options¶

--aws-basic.region¶

--aws-basic.region=<string>

AWS region where the secrets are stored.

--aws-basic.authType¶

--aws-basic.authType=<string>

Authentication type. Accepted values: Access/secret keys, Default credentials.

--aws-basic.awsAccessKey¶

--aws-basic.awsAccessKey=<string>

AWS access key. Used when --aws-basic.authType=Access/secret keys.

--aws-basic.awsSecretKey¶

--aws-basic.awsSecretKey=<string>

AWS secret key. Used when --aws-basic.authType=Access/secret keys.

--aws-basic.awsSessionToken¶

--aws-basic.awsSessionToken=<string>

AWS session token. Used when --aws-basic.authType=Access/secret keys.

--aws-basic.awsAssumeRoleName¶

--aws-basic.awsAssumeRoleName=<string>

IAM role to assume when accessing the secrets.

--aws-basic.configurationId¶

--aws-basic.configurationId=<string>

Unique identifier for this configuration.

--aws-basic.configurationName¶

--aws-basic.configurationName=<string>

Display name for this configuration.

--aws-basic.globalConfiguration¶

--aws-basic.globalConfiguration=<true|false>

Apply this configuration globally across all clients.

--aws-basic.description¶

--aws-basic.description=<string>

Optional description.

CyberArk options¶

--cyberark.baseUrl¶

--cyberark.baseUrl=<string>

URL of the Conjur OSS server (for example, https://conjur.example.com).

--cyberark.account¶

--cyberark.account=<string>

Conjur tenant or organization account name (for example, myorg).

--cyberark.username¶

--cyberark.username=<string>

Conjur user ID used for authentication.

--cyberark.apiKey¶

--cyberark.apiKey=<string>

API key associated with the Conjur user for authn login.

--cyberark.policyBranch¶

--cyberark.policyBranch=<string>

Path to the policy namespace where secrets are stored (for example, dev/app).

--cyberark.configurationId¶

--cyberark.configurationId=<string>

Unique identifier for this configuration.

--cyberark.configurationName¶

--cyberark.configurationName=<string>

Display name for this configuration.

--cyberark.trustCertificate¶

--cyberark.trustCertificate=<true|false>

Trust the CyberArk server's SSL certificate without manual import. Enable this if you're using a self-signed certificate or connecting to a server whose certificate isn't trusted by default.

--cyberark.globalConfiguration¶

--cyberark.globalConfiguration=<true|false>

Apply this configuration globally across all clients.

--cyberark.description¶

--cyberark.description=<string>

Optional description.

Google Cloud Secret Manager options¶

--gcp.project¶

--gcp.project=<string>

Google Cloud project ID where the secrets are stored.

--gcp.authType¶

--gcp.authType=<string>

Authentication type. Accepted values: Default credentials, Key file, Web Browser, OAuth (Pregenerated), Cloud Integration.

--gcp.cloudId¶

--gcp.cloudId=<string>

GCP Cloud configuration ID used for authentication. Specifies which GCP Cloud profile to use to access the secrets. Used when --gcp.authType=Cloud Integration.

--gcp.serviceAccountConfig¶

--gcp.serviceAccountConfig=<string>

Path to the service account key file. Used when --gcp.authType=Key file.

--gcp.configurationId¶

--gcp.configurationId=<string>

Unique identifier for this configuration.

--gcp.configurationName¶

--gcp.configurationName=<string>

Display name for this configuration.

--gcp.globalConfiguration¶

--gcp.globalConfiguration=<true|false>

Apply this configuration globally across all clients.

--gcp.description¶

--gcp.description=<string>

Optional description.

Vault options¶

--vault.vaultUrl¶

--vault.vaultUrl=<string>

URL of the Vault server used to retrieve secrets.

--vault.authType¶

--vault.authType=<value>

Authentication type. Accepted values: OAUTH2, TOKEN, USERNAME_PASSWORD.

--vault.vaultJwtProviderId¶

--vault.vaultJwtProviderId=<string>

Path where the JWT authentication method is enabled in Vault (for example, auth/jwt/). Used when --vault.authType=OAUTH2.

--vault.token¶

--vault.token=<string>

Authentication token required to access the Vault server. Used when --vault.authType=TOKEN.

--vault.username¶

--vault.username=<string>

Username for Vault authentication. Used when --vault.authType=USERNAME_PASSWORD.

--vault.password¶

--vault.password=<string>

Password for Vault authentication. Used when --vault.authType=USERNAME_PASSWORD.

--vault.configurationId¶

--vault.configurationId=<string>

Unique identifier for this configuration.

--vault.configurationName¶

--vault.configurationName=<string>

Display name for this configuration.

--vault.vaultRoleClaim¶

--vault.vaultRoleClaim=<string>

The claim in the JWT token that contains the Vault role name. If not set, the default role from the Vault provider is used.

--vault.globalConfiguration¶

--vault.globalConfiguration=<true|false>

Apply this configuration globally across all clients.

--vault.description¶

--vault.description=<string>

Optional description.

Examples¶

Create an AWS Secrets Manager configuration:

dbvr secret-manager create \
  --aws.region=us-east-1 \
  --aws.cloudId=my-cloud-profile \
  --aws.configurationId=aws-prod \
  --aws.configurationName="AWS Production" \
  --aws.description="Production secrets"

Create an Azure Key Vault configuration using default credentials:

dbvr secret-manager create \
  --azure.vaultName=production-vault \
  --azure.authType="Default credentials" \
  --azure.globalConfiguration=false \
  --azure.configurationId=azure-prod \
  --azure.configurationName="Azure Production"

Create a CyberArk configuration:

dbvr secret-manager create \
  --cyberark.baseUrl=https://cyberark.example.com \
  --cyberark.account=myaccount \
  --cyberark.username=admin \
  --cyberark.apiKey=myapikey \
  --cyberark.policyBranch=Root \
  --cyberark.configurationId=cyberark-prod \
  --cyberark.configurationName="CyberArk Production"

Create a Google Cloud Secret Manager configuration using a service account key file:

dbvr secret-manager create \
  --gcp.project=my-gcp-project \
  --gcp.authType="Key file" \
  --gcp.serviceAccountConfig=/path/to/service-account.json \
  --gcp.configurationId=gcp-prod \
  --gcp.configurationName="Google Production"

Create a Vault configuration using token authentication:

dbvr secret-manager create \
  --vault.vaultUrl=https://vault.example.com \
  --vault.authType=TOKEN \
  --vault.token=s.mytoken \
  --vault.vaultJwtProviderId=my-jwt-provider \
  --vault.username=vaultuser \
  --vault.password=vaultpass \
  --vault.configurationId=vault-prod \
  --vault.configurationName="Vault Production"

Info

For a complete walkthrough - including creating a Vault secret and using it with a datasource - see Secret provider setup example.