Arcus Secret Store

Arcus Security provides a centralized system for managing application secrets through a set of Arcus.Security.* NuGet packages.

Key concepts include:

• Secret Store: A central location in an application used to retrieve secrets, serving as an alternative to standard Microsoft application configuration (IConfiguration).
• Secret Provider: A registration within the secret store that handles the retrieval of secrets from a specific external source (e.g., Azure Key Vault, Docker Secrets).

While the core logic resides in Arcus.Security.Core, developers typically interact with Arcus.Security.Providers.* packages to implement specific providers.

The Arcus Secret Store, provided by the Arcus.Security.Core package, is a secure alternative to placing secrets directly into an IConfiguration instance. It separates sensitive secrets from general configuration data to prevent vulnerabilities (such as secrets appearing in logs) and provides a centralized mechanism to retrieve secrets via the ISecretProvider interface.

Key advantages include:

• Caching: Reduces calls to secret providers to avoid service limitations and supports asynchronous cache invalidation.
• Plug & Play: Allows combining multiple secret providers (e.g., multiple Azure Key Vaults) in a single retrieval process.
• Security by Design: Centralizes secret retrieval rather than scattering integration across the application.
• Extensibility: Supports custom and in-memory secret providers for testing.

The Arcus.Security.Core package provides a 'secret store' as a secure alternative to placing secrets directly into an IConfiguration instance. It separates configuration data from sensitive secrets to prevent accidental exposure (e.g., in logs) and provides a centralized way to retrieve secrets via the ISecretProvider interface.

Key advantages include:

• Caching: Reduces calls to secret providers to avoid service limits and supports asynchronous cache invalidation.
• Plug & Play: Allows querying multiple secret providers (including multiple Azure Key Vaults) in a single retrieval operation.
• Extensibility: Supports custom secret providers and in-memory providers for testing.

The Arcus.Security.Core package provides a 'secret store' as a secure alternative to placing secrets directly into an IConfiguration instance. It separates configuration data from sensitive secrets to prevent vulnerabilities (such as secrets appearing in logs) and provides a centralized way to retrieve secrets via the ISecretProvider interface. Key advantages include:

• Caching: Prevents hitting service limits and supports asynchronous cache invalidation.
• Plug & Play: Allows querying multiple secret providers (e.g., multiple Azure Key Vaults) in a single retrieval.
• Extensibility: Supports custom secret providers and in-memory providers for testing.

The Arcus.Security.Core package provides a 'secret store' as a secure alternative to placing secrets in an IConfiguration instance. It allows developers to register multiple secret providers and retrieve secrets through a single ISecretProvider interface. Key advantages include:

• Caching: Prevents hitting service limits and supports asynchronous cache invalidation.
• Plug & Play: Ability to query multiple providers (e.g., multiple Azure Key Vaults) in a single retrieval.
• Security by Design: Separates sensitive secrets from general configuration data to prevent secrets from being accidentally leaked in logs.
• Extensibility: Supports custom and in-memory secret providers for testing.

The Arcus.Security.Core package provides a 'secret store' as a secure alternative to placing secrets directly into an IConfiguration instance. It allows developers to register multiple secret providers and retrieve secrets via the ISecretProvider interface. Key advantages include:

• Caching: Prevents hitting service limits and supports asynchronous cache invalidation.
• Plug & Play: Ability to query multiple providers (e.g., multiple Azure Key Vaults) in a single retrieval.
• Security by Design: Separates sensitive secrets from general configuration data to prevent secrets from being accidentally included in logs.
• Extensibility: Supports custom and in-memory secret providers for testing.

The Arcus secret store is a flexible alternative to using standard application configuration (IConfiguration) for storing sensitive information. It allows developers to separate configuration data from secrets and supports multiple secret providers (both built-in and custom).

Key terms:

• Secret: Sensitive information such as access keys or connection strings that must remain private.
• Secret store: The central mechanism within the application used to retrieve secrets.
• Secret provider: A specific implementation that fetches secrets from a source (e.g., Azure Key Vault). A single secret store can be configured with multiple providers.