Secrets Backend Integration
Store secrets in AWS Secrets Manager, Google Cloud Secret Manager, Vault-compatible OpenBao, or a database-backed store, with the backend set by your environment's cluster config.
Facets supports multiple secret storage backends depending on your cloud provider:
AWS Secrets Manager
Default for AWS-based deployments. Secrets are stored in AWS Secrets Manager with:
- Automatic encryption at rest
- IAM-based access control
- Cross-region replication support
Google Cloud Secret Manager
Default for GCP-based deployments. Supports three replication modes:
| Mode | Description |
|---|---|
| AUTOMATIC_REPLICATION | Google manages replication across regions (default) |
| USER_MANAGED_REPLICATION | You specify which regions to replicate to |
| REGIONAL | Secrets stored in a single region only |
OpenBao (HashiCorp Vault Compatible)
For self-hosted or multi-cloud deployments:
- Compatible with HashiCorp Vault API
- On-premises secret storage option
- Custom secret engine support
Database-backed storage
For deployments without an external cloud secrets manager, Facets can store secrets through a pluggable, encrypted secrets-management backend instead of a cloud provider service. This option supports self-hosted or non-cloud setups that don't rely on AWS, GCP, or OpenBao.
Note: The secret backend is determined by your environment's cluster configuration. Contact your platform administrator to change backends.
Resource Variables
Define resource-specific variables at the blueprint level as defaults, then override them per environment with a clear hierarchy of inherited and custom values.
Onboard Apps
How developers onboard applications to Facets: configure your service and its surroundings, connect your CI/CD pipeline, and push artifacts to environments.