AdminManage secrets

Add and manage secrets (Beta)

View as Markdown

This documentation describes one or more public beta features that are in development. Beta features are subject to quick, iterative changes; therefore the current user experience in the Sigma service can differ from the information provided in this page.

This page should not be considered official published documentation until Sigma removes this notice and the beta flag on the corresponding feature(s) in the Sigma service. For the full beta feature disclaimer, see Beta features.

The use of secret manager integrations is subject to the following disclaimer.

After an organization admin has set up a secret manager integration, you can add, use, edit and delete secrets in Sigma. You can also view where these secrets are being used.

User requirements

  • An organization admin must have set up a secret manager integration in Sigma. See Set up secret manager integration.

  • The secret manager integration must have secrets available to use in Sigma. See the documentation for your secret manager platform for more information on how to add secrets.

  • You must be assigned the Admin account type to add, use, edit, delete, and view secrets in a secret manager integration.

Add secrets to a secret manager integration

To add a secret to your secret manager integration:

  1. Go to Administration > Authentication.

  2. Select the Secret managers tab.

  3. Select the secret manager integration that you want to add a secret to.

  4. In the Secrets tab, select Add secret.

  5. Enter the required information:

    • Secret name: A friendly name for use within Sigma.

    • Secret reference:

      • HashiCorp Vault: The path to the secret in Vault. If you are using KV secrets engine version 1, use the format /v1/<mount_path>/<path_to_secret>/<secret_name>. If you are using KV secrets engine version 2, use the format /v1/<mount_path>/data/<path_to_secret>/<secret_name>. If you are unsure which version you are using, see the HashiCorp Vault documentation on KV secrets engine.
      • AWS Secrets Manager: The secret name or ARN from your AWS Secrets Manager.

    • Secret format: Select JSON, Plain text, Base64, or Base64-encoded JSON.

    • Key path: (Required for JSON and Base64-encoded JSON formats) The location of your desired value inside your secret’s JSON structure. For example, if your secret is stored as:

      1{
      2  "username": "user",
      3  "password": "<password>",
      4  "password2": {
      5    "value": "<password2>"
      6  }
      7}

      The Key path for password is password and the Key path for password2 is password2.value. See Use dot notation to extract values from JSON columns for more information.

  6. Select Add. Your secret appears in the table of secrets available through the secret manager integration.

  7. Test the secret to ensure that Sigma can access it. Next to the name of the secret, select More, then select Test. A success message is shown if Sigma can access the secret.

Use secrets in Sigma

You can use secrets from your secret manager integration when you configure data platform connections and API connectors.

Use secrets when configuring connections

When setting up data platform connections in Sigma, you can use secrets from your secret manager integration to authenticate the connection:

ConnectionSupported credentials
AlloyDBPassword
Azure SQL DBPassword
BigQueryService account JSON key (basic authentication, or OAuth with a service account)
OAuth client secret (connection-level OAuth)
ClickHousePassword
DatabricksAccess token (basic authentication, or OAuth with a service account)
OAuth client secret (connection-level OAuth)
MySQLPassword
PostgreSQLPassword
RedshiftPassword
SnowflakePassword (basic authentication)
Private key and private key passphrase (key-pair authentication, or OAuth with a service account)
OAuth client secret (connection-level OAuth)
SQL ServerPassword
StarburstPassword

Use secrets when configuring a credential for an API connector

You can use secrets from your secret manager integration when you configure API connector credentials. For more information, see Configure API credentials and connectors in Sigma.

Manage existing secrets

Edit secrets

To edit an existing secret in Sigma:

  1. Go to Administration > Authentication.
  2. Select the Secret managers tab.
  3. Select the secret manager integration that contains the secret that you want to edit.
  4. In the Secrets tab, select More, then select Edit.
  5. Update the required information.
  6. Select Save.
  7. Test the edited secret to ensure that Sigma can access it. Next to the name of the secret, select More, then select Test. A success message is shown if Sigma can

Delete secrets

To delete an existing secret in Sigma:

  1. Go to Administration > Authentication.
  2. Select the Secret managers tab.
  3. Select the secret manager integration that contains the secret that you want to delete.
  4. In the Secrets tab, select More, then select Delete.
  5. Select Delete.

View secrets and secret usage

To view all secrets available in a specific secret manager integration and where these secrets are being used:

  1. Go to Administration > Authentication.
  2. Select the Secret managers tab.
  3. Select the secret manager integration that you want to view.
  4. View the information in the Secrets and Secret access tabs:
    • Secrets: View a list of all secrets available in the secret manager integration and search for specific secrets.
    • Secret access: View which connections and API connectors are currently using specific secrets.

Secret management and maintenance

Rotate public keys

Vault integrations that use the Self-signed JWT authentication method use a public key to authenticate with Vault. Regularly rotating the public key is a best practice to enhance security.

To rotate the public key:

  1. Go to Administration > Authentication.
  2. Select the Secret managers tab.
  3. Select the secret manager integration that you want to rotate the public key for.
  4. In the Public keys section, select Create new key. A new public key appears.
  5. Configure your Vault instance to recognize this new key. See the HashiCorp Vault documentation on jwt_validation_pubkeys for more information.
  6. In Sigma, activate your new key. In the Public keys section, next to the new key, select More, then select Activate.
  7. Delete the old key. Next to the old key, select More, then select Delete.