Fabric supports integration with Secrets Management services, with the intention of not storing secrets in Fabric itself.
In order to use a Secrets Management provider, you should set the configuration in the config.ini file with the selected Secrets Management provider, along with access and permission details.
Each supported Secrets Management provider has its own dedicated section in the config.ini file, with all the required access and permission details.
In addition to populating these details, you must turn it on by setting the 'ENABLED' property to 'true' in the chosen Secrets Management provider section.
The following are the required config.ini file properties for each Secrets Management provider:
Section name: [encryption_aws_sm]
properties:
Authentication process can be done by setting these properties:
ACCESS_KEY_ID
SECRET_ACCESS_KEY
The authentication can be done also by the service account, which the server is associated with. This is an alternative to using an Access ID and an Access Key.
Section name: [encryption_hashicorp_sm]
Properties
Optional properties:
Authentication is done by either tokens that can be used directly or using one of HashiCorp's other auth methods, in which case the token is dynamically generated.
Fabric supports 2 authentication methods:
Directly - where AUTH_TOKEN property should be set.
When using this method, Fabric accesses the Vault URL with the token as the auth credentials in order to get the secret.
AppRole - which is based on the role that Fabric is associated to in the Vault.
When using the AppRole method, Fabric first accesses the Approle URL to dynamically get a token, and then uses the token as the auth credentials for the purpose of getting the secret. For this method, you should specify the following properties:
Section name: [encryption_azure_sm]
Properties
Optional properties:
Authentication, Fabric supports one of the following authentication methods for Azure Key Vault and accordingly you shall set their properties:
Section name: [encryption_cyberark_sm]
Properties:
Optional properties:
Authentication is done by using either an API key or user and password, and accordingly the following parameters have to be set:
Section name: [encryption_gcp_sm]
Properties:
Optional Properties:
Authentication is done by a credentials file:
Section name: [encryption_safeguard_sm]
Properties:
Optional Properties:
TIMEOUT - default is 10000 ms.
Authentication is done by certifications and keys that should be applied.
You can use several secrets management services on the same Fabric by setting and activating them at the config.ini.
Different secrets management providers might be used by your organization, where data resources credentials are set in different providers. Fabric then is required to access different providers' services to acquire the secrets.
To use it:
Note that in the Interface Editor you can specify, per secret, which secret manager provider to use. If you do not specify, then Fabric will try find the secrets in each of the activated providers (according to their appearance in the config.ini file).
Different secrets management service instances might be used in your organization. For example, a TDM production DB resource secrets are managed at the production's secrets manager service, while the DB target resource secrets are managed by another secrets manager service instance, even though they are on same provider.
To use it:
[encryption_{my_name}_sm]
. For example, name the section for production secret manager instance as[encryption_prod_sm]
and [encryption_qa_sm]
for the QA secret manager instance.TYPE
property to that section with the name of the service provider. You can find the type by looking for the default section name, as list above. For example, the section name for AWS Secret Manager is [encryption_aws_sm]
and accordingly its type is aws
. (Note: for the default sections it is not required, that is - no need to specify its type).You can add as many sections as needed, also several instances among several providers. Later on, in the Interface Editor you shall refer and specify, per secret, which secret manager provider's instance to use.
Fabric supports integration with Secrets Management services, with the intention of not storing secrets in Fabric itself.
In order to use a Secrets Management provider, you should set the configuration in the config.ini file with the selected Secrets Management provider, along with access and permission details.
Each supported Secrets Management provider has its own dedicated section in the config.ini file, with all the required access and permission details.
In addition to populating these details, you must turn it on by setting the 'ENABLED' property to 'true' in the chosen Secrets Management provider section.
The following are the required config.ini file properties for each Secrets Management provider:
Section name: [encryption_aws_sm]
properties:
Authentication process can be done by setting these properties:
ACCESS_KEY_ID
SECRET_ACCESS_KEY
The authentication can be done also by the service account, which the server is associated with. This is an alternative to using an Access ID and an Access Key.
Section name: [encryption_hashicorp_sm]
Properties
Optional properties:
Authentication is done by either tokens that can be used directly or using one of HashiCorp's other auth methods, in which case the token is dynamically generated.
Fabric supports 2 authentication methods:
Directly - where AUTH_TOKEN property should be set.
When using this method, Fabric accesses the Vault URL with the token as the auth credentials in order to get the secret.
AppRole - which is based on the role that Fabric is associated to in the Vault.
When using the AppRole method, Fabric first accesses the Approle URL to dynamically get a token, and then uses the token as the auth credentials for the purpose of getting the secret. For this method, you should specify the following properties:
Section name: [encryption_azure_sm]
Properties
Optional properties:
Authentication, Fabric supports one of the following authentication methods for Azure Key Vault and accordingly you shall set their properties:
Section name: [encryption_cyberark_sm]
Properties:
Optional properties:
Authentication is done by using either an API key or user and password, and accordingly the following parameters have to be set:
Section name: [encryption_gcp_sm]
Properties:
Optional Properties:
Authentication is done by a credentials file:
Section name: [encryption_safeguard_sm]
Properties:
Optional Properties:
TIMEOUT - default is 10000 ms.
Authentication is done by certifications and keys that should be applied.
You can use several secrets management services on the same Fabric by setting and activating them at the config.ini.
Different secrets management providers might be used by your organization, where data resources credentials are set in different providers. Fabric then is required to access different providers' services to acquire the secrets.
To use it:
Note that in the Interface Editor you can specify, per secret, which secret manager provider to use. If you do not specify, then Fabric will try find the secrets in each of the activated providers (according to their appearance in the config.ini file).
Different secrets management service instances might be used in your organization. For example, a TDM production DB resource secrets are managed at the production's secrets manager service, while the DB target resource secrets are managed by another secrets manager service instance, even though they are on same provider.
To use it:
[encryption_{my_name}_sm]
. For example, name the section for production secret manager instance as[encryption_prod_sm]
and [encryption_qa_sm]
for the QA secret manager instance.TYPE
property to that section with the name of the service provider. You can find the type by looking for the default section name, as list above. For example, the section name for AWS Secret Manager is [encryption_aws_sm]
and accordingly its type is aws
. (Note: for the default sections it is not required, that is - no need to specify its type).You can add as many sections as needed, also several instances among several providers. Later on, in the Interface Editor you shall refer and specify, per secret, which secret manager provider's instance to use.