Secret inventory
Registry of all secrets across all HCS-managed Key Vaults. No values are documented here — only names, purposes, vault locations, and metadata. For the naming standard, see Key Vault content standard.
How to add a new secret
- Follow the Key Vault content standard to name the secret correctly
- Create the secret in the correct vault with expiry and required tags
- Add a row to the registry table below — all columns required, especially Vault
- If it feeds a pipeline, register it in ado-variable-groups.md
- If it needs to be available in local sessions, add it to
scripts/Load-HCSEnvironment.ps1 - Commit:
docs(identity): register secret <secret-name>
Registry — kv-hcs-vault-01
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
hcs-platform-github-org-pat | GitHub bootstrap PAT — kristopherjturner account — all orgs | Load-HCSEnvironment.ps1 (as GITHUB_TOKEN), gh CLI | On compromise / after GitHub App fully replaces it | 2026-05-11 | Bootstrap token. Rotate after GitHub App (hcs-platform-app) is the primary auth mechanism. |
hcs-platform-bootstrap-pat | Same value as hcs-platform-github-org-pat — explicit bootstrap alias | Invoke-GitHubSecretsDistribution.ps1, Invoke-GitHubAppInstallation.ps1 | Same as hcs-platform-github-org-pat | 2026-05-11 | Seeded as ORG_PAT into all 12 GitHub org secrets via hcs-platform-app. |
hcs-platform-github-app-id | GitHub App ID for hcs-platform-app (App ID: 3683613) | Invoke-GitHubAppInstallation.ps1 | On app recreation | 2026-05-11 | Not sensitive. App installed in all 12 orgs. |
hcs-platform-github-app-client-id | GitHub App OAuth client ID (Iv23liThz1y9CEZEE0wu) | OAuth user flows | On app recreation | 2026-05-11 | Not needed for server-to-server automation — only for OAuth user flows. |
hcs-platform-github-app-client-secret | GitHub App OAuth client secret | OAuth user flows | 180 days | 2026-05-11 | Not needed for server-to-server automation — only for OAuth user flows. |
hcs-platform-github-app-private-key | GitHub App RSA private key — signs JWTs for installation token generation | Invoke-GitHubAppInstallation.ps1 | On key rotation via GitHub App settings | 2026-05-11 | Primary auth credential for hcs-platform-app automation. Treat as high-value secret. |
hcs-platform-anthropic-api-key | Anthropic API key for Claude Code and HCS tooling | Claude Code (as ANTHROPIC_API_KEY), AzureLocal and thisismydemo org secret ANTHROPIC_API_KEY | 180 days or on compromise | 2026-05-11 | Seeded into AzureLocal + thisismydemo org secrets. Rotate after bootstrap. |
hcs-platform-cloudflare-api-token | Cloudflare API token for DNS management (hybridsolutions.cloud) | DNS management pipelines | 90 days or on compromise | 2026-05-11 | Renamed from hcs-prd-cloudflare-api-token. |
hcs-platform-azure-sub-id | Primary HCS Azure subscription ID (be069ae1-fc96-4a07-9f8e-5994d83a137d) | Load-HCSEnvironment.ps1 (as AZURE_SUBSCRIPTION_ID) | On subscription change | 2026-05-09 | Not sensitive — stored for consistency. Also seeded to AzureLocal + thisismydemo org secrets as AZURE_SUBSCRIPTION_ID. |
hcs-platform-ado-platform-pat | ADO PAT for Platform Engineering org | Load-HCSEnvironment.ps1 (as AZURE_DEVOPS_EXT_PAT), az boards, az devops CLI | 90 days | 2026-05-09 | AZURE_DEVOPS_EXT_PAT picked up automatically by az devops CLI. |
hcs-platform-swa-docs-deploy-token | SWA deploy token for swa-hcs-platform-prd-eus-01 (platform.hybridsolutions.cloud) | ADO variable group platform-prd-secrets (as AZURE_STATIC_WEB_APPS_API_TOKEN) | 365 days | 2026-05-09 | Expires 2027-05-09. Regenerate via az staticwebapp secrets list. |
hcs-vault-prospector-chocolatey-publisher-api-key | Chocolatey Community Repository publisher API key for Vault Prospector | GitHub repository secret CHOCOLATEY_API_KEY; Load-HCSEnvironment.ps1 (as CHOCOLATEY_API_KEY); SubmitPackageManagers.ps1 | 180 days or on compromise | 2026-07-16 | owner=kris@hybridsolutions.cloud; project=vault-prospector; rotation-days=180; managed-by=github-actions; lifecycle=permanent. |
hcs-vault-prospector-windows-build-username | Temporary local administrator username for the Vault Prospector HCS Tier 4 Windows build VM | vault-prospector/infrastructure/windows-fallback, Deploy-HcsWindowsFallback.ps1 | Per ephemeral build | 2026-07-24 | Paired with hcs-vault-prospector-windows-build-password; expires 2026-08-23; lifecycle=temporary. |
hcs-vault-prospector-windows-build-password | Temporary local administrator password for the Vault Prospector HCS Tier 4 Windows build VM | vault-prospector/infrastructure/windows-fallback, Deploy-HcsWindowsFallback.ps1 | Per ephemeral build | 2026-07-24 | Paired with hcs-vault-prospector-windows-build-username; expires 2026-08-23; lifecycle=temporary. Soft-delete after the ephemeral VM is removed. |
hcs-personal-github-kristopherjturner-username | GitHub login username for kristopherjturner personal account | Manual admin sessions | 30 days | 2026-05-09 | lifecycle=temporary. Expires 2026-06-08. |
hcs-personal-github-kristopherjturner-password | GitHub login password for kristopherjturner personal account | Manual admin sessions | 30 days | 2026-05-09 | lifecycle=temporary. Expires 2026-06-08. |
hcs-personal-entra-kris-hybridsolutions-cloud-username | Entra UPN for kris@hybridsolutions.cloud | Manual admin sessions, az login | 30 days | 2026-05-09 | lifecycle=temporary. Expires 2026-06-08. |
hcs-personal-entra-kris-hybridsolutions-cloud-password | Entra password for kris@hybridsolutions.cloud | Manual admin sessions, az login | 30 days | 2026-05-09 | lifecycle=temporary. Expires 2026-06-08. |
hcs-personal-entra-kristopher-turner-azurelocal-cloud-username | Entra UPN for kristopher.turner@azurelocal.cloud | Manual admin sessions (TierPoint / AzureLocal.cloud tenant) | 30 days | 2026-05-09 | lifecycle=temporary. MFA required — device code flow. Expires 2026-06-08. |
hcs-personal-entra-kristopher-turner-azurelocal-cloud-password | Entra password for kristopher.turner@azurelocal.cloud | Manual admin sessions (TierPoint / AzureLocal.cloud tenant) | 30 days | 2026-05-09 | lifecycle=temporary. MFA required — device code flow. Expires 2026-06-08. |
hcs-platform-gitlab-kjt-godmode-pat | GitLab PAT for kristopherjturner (gitlab.com) — god-mode access to all tierpoint/prodtech groups | Invoke-GitLabVariableDistribution.ps1, GitLab CI/CD group seeding | 365 days or on compromise | 2026-05-12 | Scopes: api, read_repository, write_repository. Used by AB#23/AB#406 automation. |
hcs-platform-gitlab-tp-godmode-pat | GitLab PAT for kristopher.turner@tierpoint.com — same account as kristopherjturner | Invoke-GitLabVariableDistribution.ps1 | 365 days or on compromise | 2026-05-12 | Same identity as kjt PAT — both accounts are kristopherjturner. |
hcs-platform-automation-spn-client-id | SPN client ID for hcs-platform-automation-spn (App ID: f6c58fe8-b505-40e0-9131-c47edaa24b0e) | Platform automation scripts, hybridsolutions.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). |
hcs-platform-automation-spn-secret | SPN client secret for hcs-platform-automation-spn | Platform automation scripts, hybridsolutions.cloud tenant | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
hcs-platform-mi-hcs-platform-client-id | Managed identity client ID for mi-hcs-platform (d7bbb90b-d197-44d5-b1a0-4847cb713cdc) | Platform tooling — cross-vault reads | On MI recreation | 2026-05-12 | Not sensitive — resource ID. Created via Invoke-TenantIdentitySetup.ps1 (AB#21). |
hcs-platform-mi-turnerlegacy-platform-client-id | MI client ID for mi-turnerlegacy-platform (53487ef5-3616-4449-9980-cacaa41e9b6e) | Platform tooling | On MI recreation | 2026-05-12 | turnerlegacy.org tenant (57be591b). AB#21. |
hcs-platform-mi-azlmgmt-platform-client-id | MI client ID for mi-azlmgmt-platform (327b87d3-05e7-4ea6-8363-a3ca04196a7a) | Platform tooling | On MI recreation | 2026-05-12 | azurelocal.cloud tenant (604d3138). AB#21. |
hcs-platform-mi-tpdemos-platform-client-id | MI client ID for mi-tpdemos-platform (4773d848-66b9-4940-9ca5-c724f224403b) | Platform tooling | On MI recreation | 2026-05-12 | tierpointdemos.cloud tenant (28217fed). AB#21. |
hcs-platform-mi-tppoc-platform-client-id | MI client ID for mi-tppoc-platform (185f555d-a70b-4d62-8353-fccfe86a0274) | Platform tooling | On MI recreation | 2026-05-12 | tierpointpoc.cloud tenant (2e21f99f). AB#21. |
hcs-platform-mi-tplabs-platform-client-id | MI client ID for mi-tplabs-platform (d247b73c-9863-4411-8dcd-d62f9667393b) | Platform tooling | On MI recreation | 2026-05-12 | tierpointproductlabs.cloud tenant (a9b67171). AB#21. |
hcs-platform-mi-phx-platform-client-id | MI client ID for mi-phx-platform (e20a3403-2ef5-4c6b-9c5a-66e28a323d56) | Platform tooling | On MI recreation | 2026-05-12 | projectphx.cloud tenant (c9257f80). AB#21. |
hcs-platform-mi-ptlmgmt-platform-client-id | MI client ID for mi-ptlmgmt-platform (ac0d8316-dc16-4079-8f9f-bcdf5ea2de2e) | Platform tooling | On MI recreation | 2026-05-12 | prodtechlabmgmt.com tenant (3321553e). AB#21. |
42-platform-automation-spn-client-id | SPN client ID for 42-platform-automation-spn (App ID: 3a8f6c9a-be3e-48eb-92c4-e12375424c34) | Platform automation, project-42.dev tenant (76825617-409d-4777-8986-e464f35bbcd9) | 2 years (rotate with secret) | 2026-07-26 | Entra-ID-only tenant, no subscription — no MI possible, stored centrally here instead of a per-tenant vault. Created via direct Microsoft Graph calls, not Invoke-TenantIdentitySetup.ps1 (script has an unfixed tenant-context bug for subscription-less tenants). |
42-platform-automation-spn-secret | SPN client secret for 42-platform-automation-spn | Platform automation, project-42.dev tenant | 2 years | 2026-07-26 | Expires 2028-07-27. Global Admin only in tenant 42 — no Owner @ root MG (no subscription/ARM scope exists). |
gemini-api-key | Google Gemini API key for the Invoke-HCSGeminiPrompt.ps1 REST wrapper and gemini-runner agent | scripts/Invoke-HCSGeminiPrompt.ps1 (resolved at runtime via scripts/lib/HCS.KeyVault.psm1), gemini-runner agent | 90 days or on compromise | pending Phase 0b | ACTION REQUIRED: exposed key must be rotated at aistudio.google.com before storing. Do not store the old key. Never log or display the resolved value. |
hcs-gh-runner-pat | GitHub PAT for the HCS-tenant shared Linux CI runner (KEDA ACA Job, GitHub Actions). Scopes: repo (for org-scoped runner registration). | infrastructure/runners/main.bicep (KV reference), Update-RunnerRegistration.ps1, MCP get_auth_token broker | 90 days or on compromise | pending | Used by KEDA github-runner scaler + runner registration. Rotate via GitHub → Settings → Developer settings → PATs. |
hcs-gitlab-runner-token | GitLab runner registration token for the HCS-tenant shared Linux CI runner (KEDA ACA Job, GitLab CI). | infrastructure/runners/main.bicep (KV reference), Update-RunnerRegistration.ps1 | 90 days or on compromise | pending | Group-scoped registration token for tierpoint/prodtech. Rotate via GitLab → Group → Settings → CI/CD → Runners. |
hcs-bld-vm-password | Admin password for bld-01 nested Hyper-V Windows build VM (Tier 3). | Invoke-BuildOnVm.ps1, templates/scripts/Invoke-BuildOnVm.ps1, MCP get_kv_secret | On compromise / after OS reinstall | existing | VM IP: 10.10.10.10, switch: beacon-nat. |
hcs-winbuild-vm-password | Admin password for the Tier-4 quick-deploy Windows build fallback VM (vm-hcs-winbuild-eus2-01). | infrastructure/runners/modules/windows-fallback.bicep (KV reference), Deploy-Runners.ps1 -DeployWindowsFallback | On each new VM deploy or on compromise | pending | Only stored when Tier-4 VM is deployed. Rotate after each ephemeral VM teardown. |
Cryptographic keys — kv-hcs-vault-01
| Key name | Purpose | Consumers | Rotation schedule | Created | Notes |
|---|---|---|---|---|---|
hcs-vault-prospector-release-signing-key | EC P-256 Cosign key for Vault Prospector Preview release bundles | ADO Vault Prospector Release pipeline through the HCS Platform Azure service connection | 365 days or immediately on suspected compromise | 2026-07-24 | Non-exportable Key Vault key; pipeline service principal has Key Vault Crypto User at key scope only. Public key is committed in the product repository. |
Registry — kv-turnerlegacy-prod
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
ADO-PAT | ADO PAT for Turner Legacy Platform pipelines | Turner Legacy Platform CI/CD | 90 days | — | Pre-dates naming standard. Rename on next rotation. |
CLOUDFLARE-API-TOKEN | Cloudflare API token for Turner Legacy domain DNS | Turner Legacy Platform DNS management | 90 days | — | Pre-dates naming standard. |
CLOUDFLARE-ZONE-ID | Cloudflare zone ID for Turner Legacy domain | Turner Legacy Platform DNS management | On zone change | — | Pre-dates naming standard. Not sensitive. |
COSMOS-ADMIN-PASSWORD | Cosmos DB admin password for Turner Legacy Platform app | Turner Legacy Platform API | 90 days | — | Pre-dates naming standard. |
cosmos-db-connection | Cosmos DB connection string for Turner Legacy Platform app | Turner Legacy Platform API | 90 days | — | Pre-dates naming standard. |
GITHUB-APP-CLIENT-SECRET | GitHub App client secret for Turner Legacy GitHub integration | Turner Legacy Platform | 180 days | — | Pre-dates naming standard. |
GITHUB-APP-ID | GitHub App ID for Turner Legacy GitHub integration | Turner Legacy Platform | On app change | — | Pre-dates naming standard. Not sensitive. |
GITHUB-APP-PRIVATE-KEY | GitHub App private key for Turner Legacy GitHub integration | Turner Legacy Platform | 180 days | — | Pre-dates naming standard. |
storage-connection-string | Azure Storage connection string for Turner Legacy Platform | Turner Legacy Platform | 90 days | — | Pre-dates naming standard. |
tl-platform-automation-spn-client-id | SPN client ID for tl-platform-automation-spn (App ID: a7f4c522-7238-4668-8356-8d74d61ebee0) | Platform automation scripts, turnerlegacy.org tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). |
tl-platform-automation-spn-secret | SPN client secret for tl-platform-automation-spn | Platform automation scripts, turnerlegacy.org tenant | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
Registry — kv-azlmgmt-platform
Vault for azurelocal.cloud tenant (604d3138). Created 2026-05-12 as part of AB#21.
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
azl-platform-automation-spn-client-id | SPN client ID for azl-platform-automation-spn (App ID: 92cba745-be4d-45af-b2ae-f944aa976d13) | Platform automation scripts, azurelocal.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). |
azl-platform-automation-spn-secret | SPN client secret for azl-platform-automation-spn | Platform automation scripts, azurelocal.cloud tenant | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
Registry — kv-demos-platform
Vault for tierpointdemos.cloud tenant (28217fed). Located in subscription 5e04c7f2.
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
tpdemos-platform-automation-spn-client-id | SPN client ID for tpdemos-platform-automation-spn (App ID: 4e87f1ef-f114-442a-9ab6-83dd74468cf2) | Platform automation scripts, tierpointdemos.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). Also read by Invoke-GitLabVariableDistribution.ps1 for lab-environments and azl-conference-demos group vars. |
tpdemos-platform-automation-spn-secret | SPN client secret for tpdemos-platform-automation-spn | Platform automation scripts, GitLab CI/CD group vars | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
Registry — kv-tppoc-platform
Vault for tierpointpoc.cloud tenant (2e21f99f). Created 2026-05-12 as part of AB#21.
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
tppoc-platform-automation-spn-client-id | SPN client ID for tppoc-platform-automation-spn (App ID: 1c34b4bf-c86d-4ffc-882c-bfe1ef9396d9) | Platform automation scripts, tierpointpoc.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). Read by Invoke-GitLabVariableDistribution.ps1 for tierpointpoc project vars. |
tppoc-platform-automation-spn-secret | SPN client secret for tppoc-platform-automation-spn | Platform automation scripts, GitLab CI/CD project vars | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
Registry — kv-tplabs-platform
Vault for tierpointproductlabs.cloud tenant (a9b67171). Located in subscription 2caa0b8a.
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
tplabs-platform-automation-spn-client-id | SPN client ID for tplabs-platform-automation-spn (App ID: fc07570b-f97d-41c3-a1d9-1de106503084) | Platform automation scripts, tierpointproductlabs.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). Read by Invoke-GitLabVariableDistribution.ps1 for tierpointproductlabs project vars. |
tplabs-platform-automation-spn-secret | SPN client secret for tplabs-platform-automation-spn | Platform automation scripts, GitLab CI/CD project vars | 1 year | 2026-05-12 | Expires 2027-05-11. KV_SP_SECRET set unmasked in GitLab — secret contains chars incompatible with GitLab masking. |
Registry — kv-phx-platform
Vault for projectphx.cloud tenant (c9257f80). Located in subscription 2f075d7e.
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
phx-platform-automation-spn-client-id | SPN client ID for phx-platform-automation-spn (App ID: e1953212-8a75-49ee-a031-3f7225560cd7) | Platform automation scripts, projectphx.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). Read by Invoke-GitLabVariableDistribution.ps1 for projectphx project vars. |
phx-platform-automation-spn-secret | SPN client secret for phx-platform-automation-spn | Platform automation scripts, GitLab CI/CD project vars | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
Registry — kv-ptlmgmt-platform
Vault for prodtechlabmgmt.com tenant (3321553e).
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
ptlmgmt-platform-automation-spn-client-id | SPN client ID for ptlmgmt-platform-automation-spn (App ID: 31fc0219-15a3-4022-a6f7-f4f82deade95) | Platform automation scripts, prodtechlabmgmt.com tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). Read by Invoke-GitLabVariableDistribution.ps1 for haas group vars. |
ptlmgmt-platform-automation-spn-secret | SPN client secret for ptlmgmt-platform-automation-spn | Platform automation scripts, GitLab CI/CD group vars | 1 year | 2026-05-12 | Expires 2027-05-11. KV_SP_SECRET set unmasked in GitLab (haas group) — secret contains chars incompatible with GitLab masking. |
Deleted / revoked secrets
| Secret name | Vault | Deleted on | Reason |
|---|---|---|---|
hcs-platform-github-kjt-godmode-pat | kv-hcs-vault-01 | 2026-05-11 | Superseded by hcs-platform-app installation tokens |
github-pat-classic-all-orgs | kv-hcs-vault-01 | 2026-05-11 | Old non-standard name, superseded |
github-pat-azurelocal-project-labels | kv-hcs-vault-01 | 2026-05-11 | Old one-off PAT, no longer needed |
github-azurelocalcloud-vscode-access | kv-hcs-vault-01 | 2026-05-11 | Old VS Code token, non-standard name |
vscode-all-orgs-godmode | kv-hcs-vault-01 | 2026-05-11 | Old god-mode token, superseded |
hybridcloud-kris-password | kv-hcs-vault-01 | 2026-05-11 | Old non-standard personal cred |
hybridcloud-kris-username | kv-hcs-vault-01 | 2026-05-11 | Old non-standard personal cred |
platform-docs-swa-deploy-token | kv-hcs-vault-01 | 2026-05-11 | Renamed to hcs-platform-swa-docs-deploy-token |
hcs-prd-cloudflare-api-token | kv-hcs-vault-01 | 2026-05-11 | Renamed to hcs-platform-cloudflare-api-token |
hcs-prd-ado-platform-pat | kv-hcs-vault-01 | 2026-05-11 | Renamed to hcs-platform-ado-platform-pat |
hcs-prd-azure-sub-id | kv-hcs-vault-01 | 2026-05-11 | Renamed to hcs-platform-azure-sub-id |
hcs-prd-github-org-pat | kv-hcs-vault-01 | 2026-05-11 | Renamed to hcs-platform-github-org-pat |
hcs-platform-github-kjt-password | kv-hcs-vault-01 | 2026-05-09 | Renamed per AB#20 naming standard |
hcs-platform-entra-hcs-password | kv-hcs-vault-01 | 2026-05-09 | Renamed per AB#20 naming standard |
hcs-platform-entra-azl-password | kv-hcs-vault-01 | 2026-05-09 | Renamed per AB#20 naming standard |
Vault access
Access to each vault is controlled by Azure RBAC. Minimum roles:
| Role | Capability |
|---|---|
Key Vault Secrets User | Read secrets |
Key Vault Secrets Officer | Create and update secrets |
The platform managed identity has cross-vault read access. See managed-identities.md.