Secrets Backend Integration
Store secrets in AWS Secrets Manager, Google Cloud Secret Manager, Vault-compatible OpenBao, or a database-backed store, with the backend set by your environment's cluster config.
Facets supports multiple secret storage backends depending on your cloud provider:
AWS Secrets Manager
Default for AWS-based deployments. Secrets are stored in AWS Secrets Manager with:
- Automatic encryption at rest
- IAM-based access control
- Cross-region replication support
Google Cloud Secret Manager
Default for GCP-based deployments. Supports three replication modes:
| Mode | Description |
|---|---|
| AUTOMATIC_REPLICATION | Google manages replication across regions (default) |
| USER_MANAGED_REPLICATION | You specify which regions to replicate to |
| REGIONAL | Secrets stored in a single region only |
OpenBao (HashiCorp Vault Compatible)
For self-hosted or multi-cloud deployments:
- Compatible with HashiCorp Vault API
- On-premises secret storage option
- Custom secret engine support
Database-Backed Storage
For deployments without an external cloud secrets manager, Facets can store secrets through a pluggable, encrypted secrets-management backend instead of a cloud provider service. This option supports self-hosted or non-cloud setups that don't rely on AWS, GCP, or OpenBao.
Note: The secret backend is determined by your environment's cluster configuration. Contact your platform administrator to change backends.
Resource Connections
Connect resources in Facets using dollar referencing to wire one resource's properties into another, keeping dependencies consistent across all environments.
Modules
Platform-engineering guides for Facets modules: core concepts, authoring, form UI, custom actions, versioning, the registry, and CI.