Credentials secretstore configuration

External secretstore configuration for securely managing sensitive credentials in Automation Suite.

A secretstore in Automation Suite is an external source used to store sensitive credentials. It can be either a Kubernetes Secret, an Azure Key Vault, a HashiCorp Vault, or an AWS Secrets Manager.

To use a secretstore for credentials in Automation Suite, refer to Using a secretstore for credentials.

If you are using Azure Key Vault, HashiCorp Vault, or AWS Secrets Manager as your external secret management system and plan to use your own External Secrets Operator, refer to Installing the External Secrets Operator.

In this case, make sure to add external-secrets to the excluded components list, as follows:

"exclude_components": [
        ...
        "external-secrets"
  ]

It is mandatory to run uipathctl prereq create when secretstore is enabled. For details, refer to uipathctl prereq create and uipathctl prereq run.

Using a secretstore for credentials

When deploying Automation Suite, the input.json file typically contains several sensitive data fields and credentials in plain text. To improve security, you can store these credentials in a secret store instead of including them directly in the input.json file.

A secretstore acts as an external system that securely holds sensitive credentials and configuration data. When configured, Automation Suite retrieves credentials from the defined secret store during deployment.

To enable secretstore usage, add the following section to the input.json file:

"secret_store": {
    "enabled": true
}

When this configuration is enabled, Automation Suite reads credentials from the secretstore instead of directly from the input.json file.

Vault reference pattern

Secrets in input.json are referenced using the following pattern:

vault/{vault-name}/{secret-key}?key={property}&version={version}

The following table describes the parameters of the vault reference pattern.

Parameter	Required	Description
vault-name	Yes	Maps to the name field in provider_configs
secret-key	Yes	The key/path of the secret in the external vault
key	No	Specific JSON property to extract (for structured secrets)
version	No	Specific secret version to pin. If not provided, ESO uses the latest version.

Automation Suite supports the following secretstore types:

• Kubernetes Secret
• Azure Key Vault
• HashiCorp Vault
• AWS Secrets Manager

If any credential stored in the secretstore changes, you must perform the credential update procedure. For details, refer to Updating credentials.