Alvecta.Foundation.Infrastructure.Secrets 7.1.76

Alvecta.Foundation.Infrastructure.Secrets

Keeps secrets out of configuration files: a configuration value written as secret:<name> is replaced at startup by the secret of that name, fetched from a pluggable secret store.

It belongs to the Infrastructure layer. Dependencies: Microsoft.Extensions.Configuration (+ .Abstractions). A store implementation comes separately; Alvecta.Foundation.Infrastructure.AmazonSsm provides one for AWS Systems Manager Parameter Store.

What it contains

• ISecretProvider — GetSecretsAsync(IReadOnlySet<string> secretNames, CancellationToken) returns the value of every requested secret, keyed by name, in one round trip.
• ResolveSecretsAsync(this IConfigurationManager, ISecretProvider, CancellationToken) — scans every configuration value for the secret: prefix (case-insensitive), fetches all the named secrets in a single call, and adds the plain values as an in-memory source on top. The last source wins, so every later reader of IConfiguration and of bound options sees the resolved value. A secret referenced by several keys is fetched once.

Usage

dotnet add package Alvecta.Foundation.Infrastructure.Secrets

Reference secrets by name in any configuration source (appsettings.json, environment variables, ...):

{
  "Payments": {
    "ApiKey": "secret:/Prod/Shop/PaymentsApiKey"
  }
}

Resolve them after all configuration sources are added and before the services read configuration:

using Alvecta.Foundation.Infrastructure.Secrets;

var builder = WebApplication.CreateBuilder(args);

await builder.Configuration.ResolveSecretsAsync(secretProvider, CancellationToken.None);

// builder.Configuration["Payments:ApiKey"] now holds the secret itself.

A store implements one method. For example, an in-memory store for local runs and tests:

public sealed class InMemorySecretProvider(IReadOnlyDictionary<string, string> secrets) : ISecretProvider
{
    public Task<IReadOnlyDictionary<string, string>> GetSecretsAsync(
        IReadOnlySet<string> secretNames,
        CancellationToken cancellationToken)
    {
        IReadOnlyDictionary<string, string> result = secretNames.ToDictionary(name => name, name => secrets[name]);

        return Task.FromResult(result);
    }
}

Every requested name must be in the result: a missing one throws a KeyNotFoundException during resolution.