Secrets Backend Integration
Store secrets in AWS Secrets Manager, Google Cloud Secret Manager, or Vault-compatible OpenBao, with the backend set by your environment's cluster config.
Facets supports multiple secret storage backends depending on your cloud provider:
AWS Secrets Manager
Default for AWS-based deployments. Secrets are stored in AWS Secrets Manager with:
- Automatic encryption at rest
- IAM-based access control
- Cross-region replication support
Google Cloud Secret Manager
Default for GCP-based deployments. Supports three replication modes:
| Mode | Description |
|---|---|
| AUTOMATIC_REPLICATION | Google manages replication across regions (default) |
| USER_MANAGED_REPLICATION | You specify which regions to replicate to |
| REGIONAL | Secrets stored in a single region only |
OpenBao (HashiCorp Vault Compatible)
For self-hosted or multi-cloud deployments:
- Compatible with HashiCorp Vault API
- On-premises secret storage option
- Custom secret engine support
Note: The secret backend is determined by your environment's cluster configuration. Contact your platform administrator to change backends.
Resource Connections
Connect resources in Facets using dollar referencing to wire one resource's properties into another, keeping dependencies consistent across all environments.
Modules
Platform-engineering guides for Facets modules: core concepts, authoring, form UI, custom actions, versioning, the registry, and CI.