Set up secret manager integration (Beta)

You can add and use secret manager integrations in Sigma. Secret managers store secrets, such as passwords, API keys, and other credentials, in a secure, centralized location. You can link your Sigma organization to a secret manager, then configure connections that retrieve secrets on demand instead of storing them in Sigma. Retrieving secrets on demand helps you centralize secret management and meet compliance requirements.

This document covers requirements and instructions for configuring a secret manager integration in Sigma for the following supported secret managers:

• AWS Secrets Manager
• HashiCorp Vault

For more information on how to add and manage secrets in Sigma, see Add and manage secrets.

System and user requirements

• You must be assigned the Admin account type in Sigma.
• To set up a HashiCorp Vault integration, you must have a self-hosted enterprise version of HashiCorp Vault that is publicly accessible via HTTPS. HashiCorp Vault Dedicated instances are not supported.

Configure AWS Secrets Manager integration

To configure an AWS Secrets Manager integration in Sigma, you must complete the following procedures:

• Create an Identity and Access Management (IAM) policy in AWS
• Create an IAM role in AWS
• Configure AWS Secrets Manager integration in Sigma
• Update the IAM role trust policy in AWS

After completing these procedures and adding secrets to AWS Secrets Manager, you can add and use those secrets in Sigma.

Create an Identity and Access Management (IAM) policy in AWS

Create an IAM policy that grants Sigma read access to your secrets. Refer to the AWS documentation on Creating IAM policies. The following example JSON policy grants Sigma permission to access and retrieve your secrets stored in AWS Secrets Manager:

1
{
2
  "Version": "2012-10-17",
3
  "Statement": [
4
    {
5
      "Effect": "Allow",
6
      "Action": [
7
        "secretsmanager:GetSecretValue",
8
        "secretsmanager:DescribeSecret"
9
      ],
10
      "Resource": "arn:aws:secretsmanager:<region>:<aws-account-id>:secret:*"
11
    }
12
  ]
13
}

Create an IAM role in AWS

Create this IAM role before you add an AWS Secrets Manager integration in Sigma, because the setup requires certain AWS credentials. Refer to the AWS documentation on Creating IAM roles. Sigma assumes this role to securely access your secrets. Ensure the following requirements are met when configuring the role:

• When prompted to select a trusted entity type, select Another AWS account. When prompted for an Account ID, enter your AWS account ID as a placeholder value.

• When creating the role, select Require external ID.

• When prompted for an external ID, enter a placeholder value (for example, 0000). Sigma generates an external ID when you add the AWS Secrets Manager integration, after which you must update the IAM role with the values provided by Sigma.

• Ensure multi-factor authentication (MFA) is not required.

• When prompted to select a policy, select the policy you created in the previous step.

• After you create the IAM role, copy and store the Role ARN value. You need this value when you configure the integration in Sigma.

Configure AWS Secrets Manager integration in Sigma

Create the secret manager integration in Sigma:

1. Go to Administration > Authentication.

2. Select the Secret managers tab.

3. Select Add secret manager.

4. In the Type dropdown, select AWS Secrets Manager.

5. In the Authentication method dropdown, select AWS STS.

6. Fill in the following fields:

   Field	Description	Example format
   Integration name	Enter a name for the integration.	mySecretManager
   Region	Enter the AWS Region where your secrets reside.	us-east-1
   Role ARN	Enter the Role ARN from the previous step.	arn:aws:iam::123456789012:role/SigmaSecretsRole
   Role session name	(Optional) Enter a custom session identifier for tracking requests in AWS CloudTrail logs.	sigma-secrets-session

7. For Secret format, select JSON, Plain text, Base64, or Base64-encoded JSON.

   The secret format you select here appears as the default when you add secrets to this integration. You can still select any applicable format for an individual secret.

8. Select Add. The integration appears in the list of secret manager integrations.

9. Select the name of the integration you just created to view the Secret manager details. Record the External ID and IAM principal ARN values for use when updating the IAM role trust policy in AWS.

Update the IAM role trust policy in AWS

Edit your IAM role trust policy using the External ID and IAM principal ARN values recorded when configuring the integration in Sigma. Refer to the AWS documentation on Editing the trust relationship for an existing IAM role. The following example trust policy lets Sigma assume the role, using placeholders for the IAM principal ARN and External ID:

1
{
2
  "Version": "2012-10-17",
3
  "Statement": [
4
    {
5
      "Effect": "Allow",
6
      "Principal": {
7
        "AWS": "<IAM Principal ARN generated by Sigma>"
8
      },
9
      "Action": "sts:AssumeRole",
10
      "Condition": {
11
        "StringEquals": {
12
          "sts:ExternalId": "<External ID generated by Sigma>"
13
        }
14
      }
15
    }
16
  ]
17
}

Configure HashiCorp Vault integration

When configuring a HashiCorp Vault integration in Sigma, you can choose between the Self-signed JWT and GCP Auth authentication methods. The setup process differs for each:

• Self-signed JWT
• GCP Auth

Configure HashiCorp Vault using Self-signed JWT

To configure a HashiCorp Vault integration using Self-signed JWT, you must complete the following procedures:

• Configure HashiCorp Vault integration in Sigma (Self-signed JWT)
• Configure a read-only Vault policy for JWT authentication
• Configure JWT authentication and Vault role in HashiCorp Vault

After completing these procedures and adding secrets to HashiCorp Vault, you can add and use those secrets in Sigma.

Configure HashiCorp Vault integration in Sigma (Self-signed JWT)

1. Go to Administration > Authentication.

2. Select the Secret managers tab.

3. Select Add secret manager.

4. In the Type dropdown, select HashiCorp Vault.

5. In the Authentication method dropdown, select Self-signed JWT.

6. Fill in the relevant fields:

   Field	Description	Example format
   Integration name	Enter a name for the integration in Sigma.	mySecretManager
   Vault URL	Enter the publicly accessible HTTPS URL of your Vault instance.	https://examplevault.com or https://111.222.111.222:8200
   Mount path	Enter the path where your JWT authentication method is mounted in HashiCorp Vault.	sigmaIntegration
   Vault role	Enter the role name configured in Vault for this integration.	sigmaRole
   Audience ID	Enter the unique identifier used to verify the JWT’s intended recipient.	myAudienceId
   CA certificate	(Optional) If using a private Certificate Authority, upload or paste the PEM-formatted certificate.	-----BEGIN CERTIFICATE----- MIIBszCCAVqgAwIBAgIUZ8pQmR4jN2… -----END CERTIFICATE-----

7. Select Add. The integration appears in the list of secret manager integrations.

8. Select the name of the integration you just created to view the Secret manager details. Record the following for use in later steps:

   • Subject ID
   • Issuer ID
   • Public key: Located in the Public keys section. Select More next to the active key to copy or download it.

Configure a read-only Vault policy for JWT authentication

Configure a read-only policy in HashiCorp Vault so that Sigma can access your target secrets and secrets engine configuration. Refer to the HashiCorp documentation on Creating policies. Ensure the following requirements are met when configuring the policy:

• Grant read capabilities to each secret path Sigma needs to access.
• Grant read capabilities to the sys/mounts endpoint for the relevant secrets engine.

The following are example policies based on the HashiCorp Vault secrets engine version you are using:

1
# Access to read secrets under the specified path
2
path "<mount_path_for_secret>/data/<path_to_secret>/*" {
3
  capabilities = ["read"]
4
}
5
6
# Permission to inspect secret engine metadata and path configurations
7
path "sys/mounts" {
8
  capabilities = ["read"]
9
}

1
# Access to read secrets under the specified path
2
path "<mount_path_for_secret>/<path_to_secret>/*" {
3
  capabilities = ["read"]
4
}
5
6
# Permission to inspect secret engine metadata and path configurations
7
path "sys/mounts" {
8
  capabilities = ["read"]
9
}

Configure JWT authentication and Vault role in HashiCorp Vault

Configure JWT authentication in HashiCorp Vault using the credentials you obtained in Sigma. See the HashiCorp Vault documentation on Use JWT/OIDC authentication for more information.

1. Enable the JWT authentication method in HashiCorp Vault.

2. Configure the authentication method with the Public key you obtained in Sigma. An example command to configure the authentication method is:

   Example command to configure the authentication method

   $
   # Configure the auth method with Sigma public key
   $
   vault write auth/<mount_path>/config \
   >
       jwt_validation_pubkeys=@/path/to/public_key/public_key.pub \
   >
       bound_issuer="<YOUR_ISSUER_ID>" \
   >
       jwt_supported_algs="RS256" \
   >
       audience="<YOUR_AUDIENCE_ID>"

3. Create a role that maps the Subject ID and Audience ID from Sigma to the read-only policy you created in HashiCorp Vault. An example command to create a role is:

   Example command to create a role

   $
   vault write auth/<mount_path>/role/<your_vault_role_name> \
   >
       role_type=jwt \
   >
       bound_audiences="<YOUR_AUDIENCE_ID>" \
   >
       bound_subjects="<YOUR_SUBJECT_ID>" \
   >
       token_policies="<YOUR_POLICY_NAME>" \
   >
       user_claim="sub" \
   >
       token_ttl=1h

Configure HashiCorp Vault using GCP Auth

To configure a HashiCorp Vault integration using GCP Auth, you must complete the following procedures:

• Configure a read-only Vault policy for GCP Auth
• Configure GCP Auth method in HashiCorp Vault
• (Optional) Configure Google Identity-Aware Proxy (IAP)
• Configure HashiCorp Vault integration in Sigma (GCP)

After completing these procedures and adding secrets to HashiCorp Vault, you can add and use those secrets in Sigma.

Configure a read-only Vault policy for GCP Auth

This policy must be created before adding a HashiCorp Vault integration in Sigma, so that Sigma can access your target secrets and secrets engine configuration. Refer to the HashiCorp documentation on Creating policies. Ensure the following requirements are met when configuring the policy:

• Grant read capabilities to each secret path Sigma needs to access.
• Grant read capabilities to the sys/mounts endpoint for the relevant secrets engine.

The following are example policies based on the HashiCorp Vault secrets engine version you are using:

1
# Access to read secrets under the specified path
2
path "<mount_path_for_secret>/data/<path_to_secret>/*" {
3
  capabilities = ["read"]
4
}
5
6
# Permission to inspect secret engine metadata and path configurations
7
path "sys/mounts" {
8
  capabilities = ["read"]
9
}

1
# Access to read secrets under the specified path
2
path "<mount_path_for_secret>/<path_to_secret>/*" {
3
  capabilities = ["read"]
4
}
5
6
# Permission to inspect secret engine metadata and path configurations
7
path "sys/mounts" {
8
  capabilities = ["read"]
9
}

After you create the policy, record the policy name. You need it when you configure the GCP Auth method in Vault.

Configure GCP Auth method in HashiCorp Vault

Configure the Google Cloud Platform (GCP) Auth method in HashiCorp Vault to allow GCP entities to authenticate to Vault. Refer to the HashiCorp documentation on Google Cloud auth method.

When prompted to define a Vault role (for example, sigmaRole), assign the role the read-only policy you created. Record the role name for use in later steps.

(Optional) Configure Google Identity-Aware Proxy (IAP)

Ensure the following are configured in your Google Cloud project:

• Ensure Identity-Aware Proxy is enabled for the HTTPS load balancer or backend service hosting your Vault instance. Refer to the Google Cloud documentation on Enable IAP for Compute Engine.

• Retrieve the OAuth 2.0 Client ID associated with your IAP-protected backend service (or create a custom OAuth client ID). This is required to configure the IAP client ID in Sigma. Refer to the Google Cloud documentation on Use custom OAuth clients with IAP.

• Grant the IAP-secured Web App User (roles/iap.httpsResourceAccessor) IAM role to your GCP Service Account (the account whose JSON key file you upload to Sigma). Refer to the Google Cloud documentation on Manage access to IAP-secured resources.

Configure HashiCorp Vault integration in Sigma (GCP)

1. Go to Administration > Authentication.

2. Select the Secret managers tab.

3. Select Add secret manager.

4. In the Type dropdown, select HashiCorp Vault.

5. In the Authentication method dropdown, select GCP Auth.

6. Fill in the relevant fields:

   Field	Description	Example format
   Integration name	Enter a name for the integration in Sigma.	mySecretManager
   Vault URL	Enter the fully qualified address of your Vault instance.	https://examplevault.com
   Mount path	Enter the mount path configured for GCP Auth in HashiCorp Vault.	gcp
   Vault role	Enter the role name configured in Vault for this integration.	sigmaRole
   CA certificate	(Optional) If using a private Certificate Authority, upload or paste the PEM-formatted certificate.	-----BEGIN CERTIFICATE----- MIIBszCCAVqgAwIBAgIUZ8pQmR4jN2… -----END CERTIFICATE-----
   Service account	Upload or paste the GCP service account JSON key file used by Sigma to authenticate against Vault.	See example below.

   The following is an example GCP service account JSON key file:

   1
   {
   2
     "type": "service_account",
   3
     "project_id": "project-id",
   4
     "private_key_id": "example-key",
   5
     "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBg\n-----END PRIVATE KEY-----\n",
   6
     "client_email": "sample@email.com",
   7
     "client_id": "109876543210987654321",
   8
     "auth_uri": "https://accounts.google.com/o/oauth2/auth",
   9
     "token_uri": "https://oauth2.googleapis.com/token",
   10
     "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
   11
     "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/example/gcp-auth-vault-client%example.iam.gserviceaccount.com",
   12
     "universe_domain": "googleapis.com"
   13
   }

7. (Optional) If your HashiCorp Vault instance uses GCP IAP, turn on the Enable IAP middleware toggle. Enter the relevant information:

   • IAP client ID: Enter the OAuth 2.0 Client ID for your IAP backend service obtained when configuring IAP.
   • IAP service account JSON: Upload or paste the GCP service account JSON key file authorized with the IAP-secured Web App User role.
   If your Vault GCP Auth setup and your IAP access use the same GCP service account, supply the same JSON key file in both fields.

8. Select Add. The integration appears in the list of secret manager integrations.

Add and use secrets in Sigma

After you configure a secret manager integration, you can add secrets to it and use them in your connections and API connectors. See Add and manage secrets for more information.

Related resources

• Add and manage secrets