Research & implement Secrets Manager across UGRC apps #1045

Benefit

Implementing a Secrets Manager for UGRC applications will be researched, with the ultimate goal of improving our security posture. A Secrets Manager will securely and programmatically fetch API keys, database credentials, and certificates at runtime without hardcoding them into source code. In general it will also help to streamline application maintenance across our Dev Team. Full list of benefits includes:

• Eliminating Hardcoded Credentials: Keeps API keys, database passwords, and tokens out of source code and Git repositories.
• Automating Credential Rotation: Periodically changes credentials automatically without requiring service restarts or manual code updates.
• Enabling Dynamic, Temporary Secrets: Generates short-lived, single-use credentials on demand that expire automatically, minimizing the impact of leaks.
• Centralizing Access Control & Auditing: Uses machine identity policies (IAM/RBAC) to enforce least-privilege access while logging every retrieval request for compliance.
• Simplifying Multi-Environment Management: Dynamically injects environment-specific secrets (development, staging, production) into applications at runtime.

Since UGRC is a GCP shop, it makes sense to go with Google Cloud Secret Manager, but other options can be explored as well.

Acceptance Criteria

• Research and choose a Secrets Manager
• Choose an application to use as an initial proof of concept for implementation
• Develop a priority list of applications to be migrated to usage of the selected Secrets Manager
• Schedule and begin app migration to Secrets Manager (may track this as a new and separate task)

Notes

• There did not appear to be a Secrets Manager listed in the DTS Approved Solutions list. If we try something other than Google Cloud Secret Manager, we may need to investigate what other DTS team may be using.