> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://help.sigmacomputing.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.sigmacomputing.com/_mcp/server. # Set up secret manager integration (Beta) > Integrate secret manager services with Sigma to securely manage credentials and secrets within your own infrastructure. This documentation describes one or more public beta features that are in development. Beta features are subject to quick, iterative changes; therefore the current user experience in the Sigma service can differ from the information provided in this page. This page should not be considered official published documentation until Sigma removes this notice and the beta flag on the corresponding feature(s) in the Sigma service. For the full beta feature disclaimer, see [Beta features](/docs/sigma-product-releases#beta-features). The use of secret manager integrations is subject to the following [disclaimer](/docs/notice-for-the-use-of-secret-managers-in-sigma). You can add and use secret manager integrations in Sigma. Secret managers store secrets, such as passwords, API keys, and other credentials, in a secure, centralized location. You can link your Sigma organization to a secret manager, then configure connections that retrieve secrets on demand instead of storing them in Sigma. Retrieving secrets on demand helps you centralize secret management and meet compliance requirements. This document covers requirements and instructions for configuring a secret manager integration in Sigma for the following supported secret managers: * [AWS Secrets Manager](#configure-aws-secrets-manager-integration) * [HashiCorp Vault](#configure-hashicorp-vault-integration) For more information on how to add and manage secrets in Sigma, see [Add and manage secrets](/docs/add-and-manage-secrets). Much of the secret manager integration configuration involves completing steps within an external platform. Because these workflows are maintained and updated by a third party, the steps and examples detailed in this document may differ from the secret manager platform's current UI and terminology. Always refer to the official HashiCorp Vault and AWS Secrets Manager documentation for up-to-date information. ## System and user requirements * You must be assigned the Admin [account type](/docs/create-and-manage-account-types) in Sigma. * To set up a HashiCorp Vault integration, you must have a self-hosted enterprise version of HashiCorp Vault that is publicly accessible via HTTPS. HashiCorp Vault Dedicated instances are not supported. ## Configure AWS Secrets Manager integration To configure an AWS Secrets Manager integration in Sigma, you must complete the following procedures: * [Create an Identity and Access Management (IAM) policy in AWS](#create-an-identity-and-access-management-iam-policy-in-aws) * [Create an IAM role in AWS](#create-an-iam-role-in-aws) * [Configure AWS Secrets Manager integration in Sigma](#configure-aws-secrets-manager-integration-in-sigma) * [Update the IAM role trust policy in AWS](#update-the-iam-role-trust-policy-in-aws) After completing these procedures and adding secrets to AWS Secrets Manager, you can [add and use those secrets in Sigma](#add-and-use-secrets-in-sigma). ### Create an Identity and Access Management (IAM) policy in AWS Create an IAM policy that grants Sigma read access to your secrets. Refer to the AWS documentation on Creating IAM policies. The following example JSON policy grants Sigma permission to access and retrieve your secrets stored in AWS Secrets Manager: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Resource": "arn:aws:secretsmanager:::secret:*" } ] } ``` ### Create an IAM role in AWS Create this IAM role before you add an AWS Secrets Manager integration in Sigma, because the setup requires certain AWS credentials. Refer to the AWS documentation on Creating IAM roles. Sigma assumes this role to securely access your secrets. Ensure the following requirements are met when configuring the role: * When prompted to select a trusted entity type, select **Another AWS account**. When prompted for an **Account ID**, enter your AWS account ID as a placeholder value. * When creating the role, select **Require external ID**. * When prompted for an external ID, enter a placeholder value (for example, `0000`). Sigma generates an external ID when you [add the AWS Secrets Manager integration](#configure-aws-secrets-manager-integration-in-sigma), after which you must [update the IAM role](#update-the-iam-role-trust-policy-in-aws) with the values provided by Sigma. * Ensure multi-factor authentication (MFA) is not required. * When prompted to select a policy, select the policy you created in the previous step. * After you create the IAM role, copy and store the **Role ARN** value. You need this value when you [configure the integration in Sigma](#configure-aws-secrets-manager-integration-in-sigma). ### Configure AWS Secrets Manager integration in Sigma Create the secret manager integration in Sigma: 1. Go to **Administration** > **Authentication**. 2. Select the **Secret managers** tab. 3. Select **Add secret manager**. 4. In the **Type** dropdown, select **AWS Secrets Manager**. 5. In the **Authentication method** dropdown, select **AWS STS**. 6. Fill in the following fields: | Field | Description | Example format | | :-------------------- | :----------------------------------------------------------------------------------------- | :------------------------------------------------ | | **Integration name** | Enter a name for the integration. | `mySecretManager` | | **Region** | Enter the AWS Region where your secrets reside. | `us-east-1` | | **Role ARN** | Enter the **Role ARN** from the previous step. | `arn:aws:iam::123456789012:role/SigmaSecretsRole` | | **Role session name** | (Optional) Enter a custom session identifier for tracking requests in AWS CloudTrail logs. | `sigma-secrets-session` | 7. For **Secret format**, select **JSON**, **Plain text**, **Base64**, or **Base64-encoded JSON**. The secret format you select here appears as the default when you add secrets to this integration. You can still select any applicable format for an individual secret. 8. Select **Add**. The integration appears in the list of secret manager integrations. 9. Select the name of the integration you just created to view the **Secret manager details**. Record the **External ID** and **IAM principal ARN** values for use when [updating the IAM role trust policy in AWS](#update-the-iam-role-trust-policy-in-aws). ### Update the IAM role trust policy in AWS Edit your IAM role trust policy using the **External ID** and **IAM principal ARN** values recorded when [configuring the integration in Sigma](#configure-aws-secrets-manager-integration-in-sigma). Refer to the AWS documentation on Editing the trust relationship for an existing IAM role. The following example trust policy lets Sigma assume the role, using placeholders for the **IAM principal ARN** and **External ID**: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "" } } } ] } ``` ## Configure HashiCorp Vault integration When configuring a HashiCorp Vault integration in Sigma, you can choose between the **Self-signed JWT** and **GCP Auth** authentication methods. The setup process differs for each: * [Self-signed JWT](#configure-hashicorp-vault-using-self-signed-jwt) * [GCP Auth](#configure-hashicorp-vault-using-gcp-auth) If your HashiCorp Vault instance is deployed on Google Cloud Platform (GCP), using the **GCP Auth** authentication method is recommended. If your Vault is not deployed on GCP, we recommend using the **Self-signed JWT** authentication method, as it works with any cloud platform. ### Configure HashiCorp Vault using Self-signed JWT To configure a HashiCorp Vault integration using Self-signed JWT, you must complete the following procedures: * [Configure HashiCorp Vault integration in Sigma (Self-signed JWT)](#configure-hashicorp-vault-integration-in-sigma-self-signed-jwt) * [Configure a read-only Vault policy for JWT authentication](#configure-a-read-only-vault-policy-for-jwt-authentication) * [Configure JWT authentication and Vault role in HashiCorp Vault](#configure-jwt-authentication-and-vault-role-in-hashicorp-vault) After completing these procedures and adding secrets to HashiCorp Vault, you can [add and use those secrets in Sigma](#add-and-use-secrets-in-sigma). #### Configure HashiCorp Vault integration in Sigma (Self-signed JWT) 1. Go to **Administration** > **Authentication**. 2. Select the **Secret managers** tab. 3. Select **Add secret manager**. 4. In the **Type** dropdown, select **HashiCorp Vault**. 5. In the **Authentication method** dropdown, select **Self-signed JWT**. 6. Fill in the relevant fields: | Field | Description | Example format | | :------------------- | :-------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------- | | **Integration name** | Enter a name for the integration in Sigma. | `mySecretManager` | | **Vault URL** | Enter the publicly accessible HTTPS URL of your Vault instance. | `https://examplevault.com` or `https://111.222.111.222:8200` | | **Mount path** | Enter the path where your JWT authentication method is mounted in HashiCorp Vault. | `sigmaIntegration` | | **Vault role** | Enter the role name configured in Vault for this integration. | `sigmaRole` | | **Audience ID** | Enter the unique identifier used to verify the JWT's intended recipient. | `myAudienceId` | | **CA certificate** | (Optional) If using a private Certificate Authority, upload or paste the PEM-formatted certificate. | `-----BEGIN CERTIFICATE----- MIIBszCCAVqgAwIBAgIUZ8pQmR4jN2… -----END CERTIFICATE-----` | 7. Select **Add**. The integration appears in the list of secret manager integrations. 8. Select the name of the integration you just created to view the **Secret manager details**. Record the following for use in later steps: * **Subject ID** * **Issuer ID** * **Public key**: Located in the **Public keys** section. Select **More** next to the active key to copy or download it. #### Configure a read-only Vault policy for JWT authentication Configure a read-only policy in HashiCorp Vault so that Sigma can access your target secrets and secrets engine configuration. Refer to the HashiCorp documentation on Creating policies. Ensure the following requirements are met when configuring the policy: * Grant read capabilities to each secret path Sigma needs to access. * Grant read capabilities to the `sys/mounts` endpoint for the relevant secrets engine. The following are example policies based on the HashiCorp Vault secrets engine version you are using: #### Example policy for KV version 2 secrets engine ```hcl # Access to read secrets under the specified path path "/data//*" { capabilities = ["read"] } # Permission to inspect secret engine metadata and path configurations path "sys/mounts" { capabilities = ["read"] } ``` #### Example policy for KV version 1 secrets engine ```hcl # Access to read secrets under the specified path path "//*" { capabilities = ["read"] } # Permission to inspect secret engine metadata and path configurations path "sys/mounts" { capabilities = ["read"] } ``` #### Configure JWT authentication and Vault role in HashiCorp Vault Configure JWT authentication in HashiCorp Vault using the credentials you obtained in Sigma. See the HashiCorp Vault documentation on Use JWT/OIDC authentication for more information. 1. Enable the JWT authentication method in HashiCorp Vault. 2. Configure the authentication method with the **Public key** you obtained in Sigma. An example command to configure the authentication method is: #### Example command to configure the authentication method ```shell # Configure the auth method with Sigma public key vault write auth//config \ jwt_validation_pubkeys=@/path/to/public_key/public_key.pub \ bound_issuer="" \ jwt_supported_algs="RS256" \ audience="" ``` 3. Create a role that maps the **Subject ID** and **Audience ID** from Sigma to the read-only policy you created in HashiCorp Vault. An example command to create a role is: #### Example command to create a role ```shell vault write auth//role/ \ role_type=jwt \ bound_audiences="" \ bound_subjects="" \ token_policies="" \ user_claim="sub" \ token_ttl=1h ``` ### Configure HashiCorp Vault using GCP Auth To configure a HashiCorp Vault integration using GCP Auth, you must complete the following procedures: * [Configure a read-only Vault policy for GCP Auth](#configure-a-read-only-vault-policy-for-gcp-auth) * [Configure GCP Auth method in HashiCorp Vault](#configure-gcp-auth-method-in-hashicorp-vault) * [(Optional) Configure Google Identity-Aware Proxy (IAP)](#optional-configure-google-identity-aware-proxy-iap) * [Configure HashiCorp Vault integration in Sigma (GCP)](#configure-hashicorp-vault-integration-in-sigma-gcp) After completing these procedures and adding secrets to HashiCorp Vault, you can [add and use those secrets in Sigma](#add-and-use-secrets-in-sigma). #### Configure a read-only Vault policy for GCP Auth This policy must be created before adding a HashiCorp Vault integration in Sigma, so that Sigma can access your target secrets and secrets engine configuration. Refer to the HashiCorp documentation on Creating policies. Ensure the following requirements are met when configuring the policy: * Grant read capabilities to each secret path Sigma needs to access. * Grant read capabilities to the `sys/mounts` endpoint for the relevant secrets engine. The following are example policies based on the HashiCorp Vault secrets engine version you are using: #### Example policy for KV version 2 secrets engine ```hcl # Access to read secrets under the specified path path "/data//*" { capabilities = ["read"] } # Permission to inspect secret engine metadata and path configurations path "sys/mounts" { capabilities = ["read"] } ``` #### Example policy for KV version 1 secrets engine ```hcl # Access to read secrets under the specified path path "//*" { capabilities = ["read"] } # Permission to inspect secret engine metadata and path configurations path "sys/mounts" { capabilities = ["read"] } ``` After you create the policy, record the policy name. You need it when you configure the GCP Auth method in Vault. #### Configure GCP Auth method in HashiCorp Vault Configure the Google Cloud Platform (GCP) Auth method in HashiCorp Vault to allow GCP entities to authenticate to Vault. Refer to the HashiCorp documentation on Google Cloud auth method. When prompted to define a Vault role (for example, `sigmaRole`), assign the role the read-only policy you created. Record the role name for use in later steps. #### (Optional) Configure Google Identity-Aware Proxy (IAP) This step is only required if you plan to use Google Identity-Aware Proxy (IAP) with your HashiCorp Vault instance. If you do not plan to use IAP, proceed to [configuring your HashiCorp Vault integration in Sigma](#configure-hashicorp-vault-integration-in-sigma-gcp). Ensure the following are configured in your Google Cloud project: * Ensure Identity-Aware Proxy is enabled for the HTTPS load balancer or backend service hosting your Vault instance. Refer to the Google Cloud documentation on Enable IAP for Compute Engine. * Retrieve the OAuth 2.0 Client ID associated with your IAP-protected backend service (or create a custom OAuth client ID). This is required to configure the **IAP client ID** in Sigma. Refer to the Google Cloud documentation on Use custom OAuth clients with IAP. * Grant the **IAP-secured Web App User** (`roles/iap.httpsResourceAccessor`) IAM role to your GCP Service Account (the account whose JSON key file you upload to Sigma). Refer to the Google Cloud documentation on Manage access to IAP-secured resources. #### Configure HashiCorp Vault integration in Sigma (GCP) 1. Go to **Administration** > **Authentication**. 2. Select the **Secret managers** tab. 3. Select **Add secret manager**. 4. In the **Type** dropdown, select **HashiCorp Vault**. 5. In the **Authentication method** dropdown, select **GCP Auth**. 6. Fill in the relevant fields: | Field | Description | Example format | | :------------------- | :-------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------- | | **Integration name** | Enter a name for the integration in Sigma. | `mySecretManager` | | **Vault URL** | Enter the fully qualified address of your Vault instance. | `https://examplevault.com` | | **Mount path** | Enter the mount path configured for GCP Auth in HashiCorp Vault. | `gcp` | | **Vault role** | Enter the role name configured in Vault for this integration. | `sigmaRole` | | **CA certificate** | (Optional) If using a private Certificate Authority, upload or paste the PEM-formatted certificate. | `-----BEGIN CERTIFICATE----- MIIBszCCAVqgAwIBAgIUZ8pQmR4jN2… -----END CERTIFICATE-----` | | **Service account** | Upload or paste the GCP service account JSON key file used by Sigma to authenticate against Vault. | See example below. | The following is an example GCP service account JSON key file: ```json { "type": "service_account", "project_id": "project-id", "private_key_id": "example-key", "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBg\n-----END PRIVATE KEY-----\n", "client_email": "sample@email.com", "client_id": "109876543210987654321", "auth_uri": "https://accounts.google.com/o/oauth2/auth", "token_uri": "https://oauth2.googleapis.com/token", "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/example/gcp-auth-vault-client%example.iam.gserviceaccount.com", "universe_domain": "googleapis.com" } ``` 7. (Optional) If your HashiCorp Vault instance uses GCP IAP, turn on the **Enable IAP middleware** toggle. Enter the relevant information: * **IAP client ID**: Enter the OAuth 2.0 Client ID for your IAP backend service obtained when [configuring IAP](#optional-configure-google-identity-aware-proxy-iap). * **IAP service account JSON**: Upload or paste the GCP service account JSON key file authorized with the IAP-secured Web App User role. If your Vault GCP Auth setup and your IAP access use the same GCP service account, supply the same JSON key file in both fields. 8. Select **Add**. The integration appears in the list of secret manager integrations. ## Add and use secrets in Sigma After you configure a secret manager integration, you can add secrets to it and use them in your connections and API connectors. See [Add and manage secrets](/docs/add-and-manage-secrets#add-secrets-to-a-secret-manager-integration) for more information. ## Related resources * [Add and manage secrets](/docs/add-and-manage-secrets)