Secrets Management Architecture

Overview

A strategic framework for implementing dual-tier secrets management that separates machine-level secrets (OpenBao) from human-level credentials (Bitwarden). This architecture minimizes blast radius of credential leaks by enforcing strict separation of concerns between automated infrastructure secrets and user-facing authentication.

Architecture

Machine Secrets (OpenBao)

• Short-lived, dynamically generated credentials for databases, APIs, and cloud services
• Just-In-Time (JIT) access with short TTLs to minimize vulnerability windows
• Secret injection via agents or sidecars (not environment variables) to prevent exposure in process lists

Human Secrets (Bitwarden)

• Long-lived credentials: passwords, secure notes, recovery codes
• OpenBao’s unseal keys and emergency root tokens stored in restricted Bitwarden collections
• Self-hosted for data sovereignty

Integration Points

• Both tools integrate with central Identity Provider (IdP) via OIDC or SAML
• Cross-tool disaster recovery: Bitwarden protects the master keys necessary for OpenBao restoration
• CLI tools inject secrets directly into development environments, eliminating insecure plaintext .env files

See Also

• backend-security-principles - Secrets management best practices within backend security
• hardened-remote-access - Access control hierarchy complementing secrets architecture
• resilient-infrastructure-zero-trust - Comprehensive zero-trust security framework