Secrets and Pipeline Configuration
Secret references let a pipeline describe which credential it needs without repeating the credential value in each component. Configure a provider, define a named reference, and use that reference in the component configuration.
The Secrets editor is available when enabled for your account. If the control is not visible, contact [email protected].
Configure a provider
In the pipeline editor, open Secrets and select a provider type. The current Cloud editor includes:
- File.
- AWS Secrets Manager.
- AWS Systems Manager Parameter Store.
- AWS STS.
- Azure Key Vault.
- HashiCorp Vault.
Supply the provider configuration appropriate to the environment where the pipeline will execute. Then add named secret mappings and reference them from component fields. The editor provides views for listing and editing providers and their secret references.
Provider configuration and references travel with the job specification. The nodes still need the identity, permissions, network access, and any local files required to resolve them. A reference is not a copy of the underlying secret store or a grant of access to it.
Reuse configuration across environments
Choose stable reference names for credentials used by multiple components. When reusing pipeline logic in another workspace, verify that its provider configuration resolves the intended environment's secret rather than a staging or development value.
Review provider-specific documentation for authentication, refresh, caching, and rotation behavior. Those details depend on the provider and runtime; the presence of an editor control alone does not define their behavior.
See Secret providers and the provider reference for the runtime configuration surface. The runtime reference and the Cloud editor's provider picker may expose different sets of options.
Keep test and assistant input appropriate
Avoid putting raw credentials into sample records or assistant conversations. Configuration submitted to Cloud can include the values you type into it. Use named references and synthetic or redacted samples when evaluating a pipeline in the editor.
For access to Cloud itself, use organization roles and API keys. For credentials used by a source or destination, use the relevant component and secret-provider settings.
