Secrets management dans le cloud : architectures 2025

Architecture 3 couches secrets management cloud
────────────────────────────────────────────────
Couche 3 — CONSOMMATION
  External Secrets Operator / Secrets Store CSI Driver / Vault Agent
  SDK native retrieval (boto3, azure-keyvault, google-secretmanager)
  SOPS pour fichiers de configuration infra
       │
       │  (lecture de secrets avec identité cloud)
       ▼
Couche 2 — STORE
  AWS Secrets Manager ─┐
  Azure Key Vault       ├─► centralisation, rotation, audit, versioning
  GCP Secret Manager   ─┘
  HashiCorp Vault (self-hosted ou HCP)
       │
       │  (autorisation via IAM policy)
       ▼
Couche 1 — IDENTITÉ
  IRSA (AWS EKS)
  Workload Identity (GKE)
  Azure Workload Identity
  Instance Profile / Managed Identity (VM)
  OIDC federation CI/CD (GitHub Actions, GitLab CI)
       │
       │  (pas de credential statique stocké)
       ▼
  Pods / Functions / VMs / Workflows CI

# ServiceAccount Kubernetes annoté avec le rôle IAM à assumer
apiVersion: v1
kind: ServiceAccount
metadata:
  name: api-backend
  namespace: production
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/ApiBackendRole
---
# Deployment qui utilise le ServiceAccount
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-backend
  namespace: production
spec:
  template:
    spec:
      serviceAccountName: api-backend
      containers:
        - name: api
          image: 123456789012.dkr.ecr.eu-west-3.amazonaws.com/api:v1.2.3
          # Aucune variable AWS_ACCESS_KEY_ID ou AWS_SECRET_ACCESS_KEY
          # Les credentials AWS sont injectés automatiquement via token OIDC

# ServiceAccount Kubernetes lié à un Google Service Account
apiVersion: v1
kind: ServiceAccount
metadata:
  name: api-backend
  namespace: production
  annotations:
    iam.gke.io/gcp-service-account: api-backend@my-project.iam.gserviceaccount.com

gcloud iam service-accounts add-iam-policy-binding \
    api-backend@my-project.iam.gserviceaccount.com \
    --role roles/iam.workloadIdentityUser \
    --member "serviceAccount:my-project.svc.id.goog[production/api-backend]"

apiVersion: v1
kind: ServiceAccount
metadata:
  name: api-backend
  namespace: production
  annotations:
    azure.workload.identity/client-id: 00000000-0000-0000-0000-000000000000
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-backend
spec:
  template:
    metadata:
      labels:
        azure.workload.identity/use: "true"
    spec:
      serviceAccountName: api-backend

# .github/workflows/deploy.yml — zéro credential AWS stocké dans les secrets GitHub
name: Deploy
on:
  push:
    branches: [main]
permissions:
  id-token: write  # autorise la création de JWT OIDC par GitHub
  contents: read
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Configure AWS credentials via OIDC
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsDeployRole
          aws-region: eu-west-3
          # Pas de aws-access-key-id / aws-secret-access-key — OIDC federation
      - name: Deploy
        run: ./scripts/deploy.sh

# Enable du moteur database Vault
vault secrets enable database
 
# Configuration du backend PostgreSQL
vault write database/config/prod-postgres \
    plugin_name=postgresql-database-plugin \
    allowed_roles="api-readonly" \
    connection_url="postgresql://{{username}}:{{password}}@prod-db:5432/" \
    username="vault-root" \
    password="redacted"
 
# Configuration du rôle avec TTL 1h
vault write database/roles/api-readonly \
    db_name=prod-postgres \
    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
                         GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
    default_ttl="1h" \
    max_ttl="24h"
 
# Une application authentifiée demande un credential éphémère
vault read database/creds/api-readonly
# Retourne : username="v-token-api-readonly-abc123def456", password=..., expiration=2026-04-24T10:00:00+02:00

# SecretStore : connexion au backend AWS Secrets Manager via IRSA
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: aws-secrets-manager
  namespace: production
spec:
  provider:
    aws:
      service: SecretsManager
      region: eu-west-3
      auth:
        jwt:
          serviceAccountRef:
            name: external-secrets-sa  # lié à un rôle IAM avec secretsmanager:GetSecretValue
---
# ExternalSecret : déclaration d'un secret à synchroniser
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: api-backend-db
  namespace: production
spec:
  refreshInterval: 1h  # re-lecture toutes les heures
  secretStoreRef:
    name: aws-secrets-manager
    kind: SecretStore
  target:
    name: api-backend-db  # nom du Secret Kubernetes créé
  dataFrom:
    - extract:
        key: prod/api-backend/db  # clé dans AWS Secrets Manager

apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: api-backend-secrets
  namespace: production
spec:
  provider: aws
  parameters:
    objects: |
      - objectName: "prod/api-backend/db"
        objectType: "secretsmanager"
        jmesPath:
          - path: "password"
            objectAlias: "db_password"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-backend
spec:
  template:
    spec:
      serviceAccountName: api-backend  # IRSA
      containers:
        - name: api
          volumeMounts:
            - name: secrets
              mountPath: /mnt/secrets
              readOnly: true
      volumes:
        - name: secrets
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: api-backend-secrets

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-backend
spec:
  template:
    metadata:
      annotations:
        vault.hashicorp.com/agent-inject: "true"
        vault.hashicorp.com/role: "api-backend"
        vault.hashicorp.com/agent-inject-secret-db: "database/creds/api-readonly"
        vault.hashicorp.com/agent-inject-template-db: |
          {{- with secret "database/creds/api-readonly" -}}
          export DB_USER="{{ .Data.username }}"
          export DB_PASS="{{ .Data.password }}"
          {{- end }}

# Configuration .sops.yaml
cat > .sops.yaml <<'EOF'
creation_rules:
  - path_regex: \.enc\.yaml$
    kms: arn:aws:kms:eu-west-3:123456789012:alias/sops-infra
    encrypted_regex: "^(password|secret|key|token|credentials)$"
EOF
 
# Chiffrement d'un fichier
sops --encrypt values.prod.yaml > values.prod.enc.yaml
 
# Edition in-place
sops values.prod.enc.yaml
 
# Utilisation dans Helm via helm-secrets plugin
helm secrets upgrade --install myapp ./chart -f values.prod.enc.yaml

# Terraform — rotation auto d'un secret RDS tous les 30 jours
resource "aws_secretsmanager_secret" "db_credentials" {
  name                    = "prod/api-backend/db"
  recovery_window_in_days = 7
}
 
resource "aws_secretsmanager_secret_rotation" "db_credentials" {
  secret_id           = aws_secretsmanager_secret.db_credentials.id
  rotation_lambda_arn = aws_lambda_function.rotate_db_creds.arn
 
  rotation_rules {
    automatically_after_days = 30
  }
}
 
resource "aws_lambda_function" "rotate_db_creds" {
  function_name = "rotate-db-credentials"
  runtime       = "python3.12"
  # Code basé sur AWS-provided PostgreSQL single-user rotation template
  # https://github.com/aws-samples/aws-secrets-manager-rotation-lambdas
  filename      = "rotation_lambda.zip"
  role          = aws_iam_role.rotation_lambda.arn
  handler       = "lambda_function.lambda_handler"
  timeout       = 30
}

Fréquences de rotation recommandées — ETI typique 2025
──────────────────────────────────────────────────────
Credentials DB production (RDS, Aurora, Cloud SQL)    30-90 jours
API keys partenaires critiques                         90-180 jours
OAuth2 client secrets                                  6-12 mois
JWT signing keys                                       3-6 mois
TLS certificates internal                              90 jours (Let's Encrypt 90j, ACM auto-renew)
TLS certificates public (EV/OV)                        1 an max (CAB Forum 398j)
Tokens service-to-service                              Éphémères (Workload Identity) — pas de rotation
Cryptographic keys data-at-rest                        1-2 ans (NIST SP 800-57)

# gitleaks — scan historique complet avec config .gitleaks.toml
gitleaks detect --source . --redact --report-path leaks.json
 
# truffleHog — détection IA-assistée de patterns
trufflehog git file://. --only-verified --json > leaks.json
 
# Trivy — scan état courant (pas historique)
trivy fs --scanners secret .

{
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "GetSecretValue",
  "userIdentity": {
    "type": "AssumedRole",
    "arn": "arn:aws:sts::123456789012:assumed-role/ApiBackendRole/i-0a1b2c3d"
  },
  "requestParameters": {
    "secretId": "arn:aws:secretsmanager:eu-west-3:123456789012:secret:prod/api-backend/db"
  },
  "sourceIPAddress": "172.16.1.42",
  "eventTime": "2026-04-24T09:15:42Z"
}