Secret inventory
Registry of all secrets across all HCS-managed Key Vaults. No values are documented here — only names, purposes, vault locations, and metadata. For the naming standard, see Key Vault content standard.
How to add a new secret
- Follow the Key Vault content standard to name the secret correctly
- Create the secret in the correct vault with expiry and required tags
- Add a row to the registry table below — all columns required, especially Vault
- If it feeds a pipeline, register it in ado-variable-groups.md
- If it needs to be available in local sessions, add it to
scripts/Load-HCSEnvironment.ps1 - Commit:
docs(identity): register secret <secret-name>
Federated access that intentionally has no secret entry
AWS IAM Identity Center sessions, AWS CLI SSO cache entries, IAM role credentials, EC2 instance profiles, Azure managed identities, and CI workload-federation tokens do not create Key Vault secrets. Document their identity and trust relationship in the appropriate access or identity runbook, but do not add placeholder secrets to this inventory.
For the AWS pattern, see AWS federated access. Apple signing private keys, certificate-export passwords, and a generated macOS GUI password are genuine secrets and must be added here when they are created.
Registry — kv-hcs-vault-01
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
hcs-platform-github-org-pat | GitHub bootstrap PAT — kristopherjturner account — all orgs | Load-HCSEnvironment.ps1 (as GITHUB_TOKEN), gh CLI | On compromise / after GitHub App fully replaces it | 2026-05-11 | Bootstrap token. Rotate after GitHub App (hcs-platform-app) is the primary auth mechanism. |
hcs-platform-bootstrap-pat | Same value as hcs-platform-github-org-pat — explicit bootstrap alias | Invoke-GitHubSecretsDistribution.ps1, Invoke-GitHubAppInstallation.ps1 | Same as hcs-platform-github-org-pat | 2026-05-11 | Seeded as ORG_PAT into all 12 GitHub org secrets via hcs-platform-app. |
hcs-platform-github-app-id | GitHub App ID for hcs-platform-app (App ID: 3683613) | Invoke-GitHubAppInstallation.ps1 | On app recreation | 2026-05-11 | Not sensitive. App installed in all 12 orgs. |
hcs-platform-github-app-client-id | GitHub App OAuth client ID (Iv23liThz1y9CEZEE0wu) | OAuth user flows | On app recreation | 2026-05-11 | Not needed for server-to-server automation — only for OAuth user flows. |
hcs-platform-github-app-client-secret | GitHub App OAuth client secret | OAuth user flows | 180 days | 2026-05-11 | Not needed for server-to-server automation — only for OAuth user flows. |
hcs-platform-github-app-private-key | GitHub App RSA private key — signs JWTs for installation token generation | Invoke-GitHubAppInstallation.ps1 | On key rotation via GitHub App settings | 2026-05-11 | Primary auth credential for hcs-platform-app automation. Treat as high-value secret. |
hcs-platform-anthropic-api-key | Anthropic API key for Claude Code and HCS tooling | Claude Code (as ANTHROPIC_API_KEY), AzureLocal and thisismydemo org secret ANTHROPIC_API_KEY | 180 days or on compromise | 2026-05-11 | Seeded into AzureLocal + thisismydemo org secrets. Rotate after bootstrap. |
hcs-platform-cloudflare-api-token | Cloudflare API token for DNS management (hybridsolutions.cloud) | DNS management pipelines | 90 days or on compromise | 2026-05-11 | Renamed from hcs-prd-cloudflare-api-token. |
hcs-platform-azure-sub-id | Primary HCS Azure subscription ID (be069ae1-fc96-4a07-9f8e-5994d83a137d) | Load-HCSEnvironment.ps1 (as AZURE_SUBSCRIPTION_ID) | On subscription change | 2026-05-09 | Not sensitive — stored for consistency. Also seeded to AzureLocal + thisismydemo org secrets as AZURE_SUBSCRIPTION_ID. |
hcs-platform-ado-platform-pat | ADO PAT for Platform Engineering org | Load-HCSEnvironment.ps1 (as AZURE_DEVOPS_EXT_PAT), az boards, az devops CLI | 90 days | 2026-05-09 | AZURE_DEVOPS_EXT_PAT picked up automatically by az devops CLI. |
hcs-platform-swa-docs-deploy-token | SWA deploy token for swa-hcs-platform-prd-eus-01 (platform.hybridsolutions.cloud) | ADO variable group platform-prd-secrets (as AZURE_STATIC_WEB_APPS_API_TOKEN) | 365 days | 2026-05-09 | Expires 2027-05-09. Regenerate via az staticwebapp secrets list. |
hcs-vault-prospector-chocolatey-publisher-api-key | Chocolatey Community Repository publisher API key for Vault Prospector | GitHub repository secret CHOCOLATEY_API_KEY; Load-HCSEnvironment.ps1 (as CHOCOLATEY_API_KEY); SubmitPackageManagers.ps1 | 180 days or on compromise | 2026-07-16 | owner=kris@hybridsolutions.cloud; project=vault-prospector; rotation-days=180; managed-by=github-actions; lifecycle=permanent. |
hcs-vault-prospector-windows-build-username | Temporary local administrator username for the Vault Prospector HCS Tier 4 Windows build VM | vault-prospector/infrastructure/windows-fallback, Deploy-HcsWindowsFallback.ps1 | Per ephemeral build | 2026-07-24 | Paired with hcs-vault-prospector-windows-build-password; expires 2026-08-23; lifecycle=temporary. |
hcs-vault-prospector-windows-build-password | Temporary local administrator password for the Vault Prospector HCS Tier 4 Windows build VM | vault-prospector/infrastructure/windows-fallback, Deploy-HcsWindowsFallback.ps1 | Per ephemeral build | 2026-07-24 | Paired with hcs-vault-prospector-windows-build-username; expires 2026-08-23; lifecycle=temporary. Soft-delete after the ephemeral VM is removed. |
hcs-personal-github-kristopherjturner-username | GitHub login username for kristopherjturner personal account | Manual admin sessions | 30 days | 2026-05-09 | lifecycle=temporary. Expires 2026-06-08. |
hcs-personal-github-kristopherjturner-password | GitHub login password for kristopherjturner personal account | Manual admin sessions | 30 days | 2026-05-09 | lifecycle=temporary. Expires 2026-06-08. |
hcs-personal-entra-kris-hybridsolutions-cloud-username | Entra UPN for kris@hybridsolutions.cloud | Manual admin sessions, az login | 30 days | 2026-05-09 | lifecycle=temporary. Expires 2026-06-08. |
hcs-personal-entra-kris-hybridsolutions-cloud-password | Entra password for kris@hybridsolutions.cloud | Manual admin sessions, az login | 30 days | 2026-05-09 | lifecycle=temporary. Expires 2026-06-08. |
hcs-personal-entra-kristopher-turner-azurelocal-cloud-username | Entra UPN for kristopher.turner@azurelocal.cloud | Manual admin sessions (TierPoint / AzureLocal.cloud tenant) | 30 days | 2026-05-09 | lifecycle=temporary. MFA required — device code flow. Expires 2026-06-08. |
hcs-personal-entra-kristopher-turner-azurelocal-cloud-password | Entra password for kristopher.turner@azurelocal.cloud | Manual admin sessions (TierPoint / AzureLocal.cloud tenant) | 30 days | 2026-05-09 | lifecycle=temporary. MFA required — device code flow. Expires 2026-06-08. |
hcs-platform-gitlab-kjt-godmode-pat | GitLab PAT for kristopherjturner (gitlab.com) — god-mode access to all tierpoint/prodtech groups | Invoke-GitLabVariableDistribution.ps1, GitLab CI/CD group seeding | 365 days or on compromise | 2026-05-12 | Scopes: api, read_repository, write_repository. Used by AB#23/AB#406 automation. |
hcs-platform-gitlab-tp-godmode-pat | Rejected legacy GitLab PAT | None; soft-deleted 2026-09-17 | Retired | 2026-09-17 | GitLab returned HTTP 401; identity equivalence with the KJT PAT was not proven. The former CI copies and unused MCP reference were removed before soft-delete. |
hcs-platform-gitlab-prodtech-variable-admin-token | Group-owned GitLab API token for tierpoint/prodtech variable administration | Invoke-GitLabVariableDistribution.ps1, Test-PlatformSecrets.ps1 | 90 days | 2026-09-17 | Owner role and API scope within the ProdTech group only; expires 2026-12-16. Never distribute it into CI variables or browser builds. |
hcs-platform-automation-spn-client-id | SPN client ID for hcs-platform-automation-spn (App ID: f6c58fe8-b505-40e0-9131-c47edaa24b0e) | Platform automation scripts, hybridsolutions.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). |
hcs-platform-automation-spn-secret | SPN client secret for hcs-platform-automation-spn | Platform automation scripts, hybridsolutions.cloud tenant | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
hcs-platform-mi-hcs-platform-client-id | Managed identity client ID for mi-hcs-platform (d7bbb90b-d197-44d5-b1a0-4847cb713cdc) | Platform tooling — cross-vault reads | On MI recreation | 2026-05-12 | Not sensitive — resource ID. Created via Invoke-TenantIdentitySetup.ps1 (AB#21). |
hcs-platform-mi-turnerlegacy-platform-client-id | MI client ID for mi-turnerlegacy-platform (53487ef5-3616-4449-9980-cacaa41e9b6e) | Platform tooling | On MI recreation | 2026-05-12 | turnerlegacy.org tenant (57be591b). AB#21. |
hcs-platform-mi-azlmgmt-platform-client-id | MI client ID for mi-azlmgmt-platform (327b87d3-05e7-4ea6-8363-a3ca04196a7a) | Platform tooling | On MI recreation | 2026-05-12 | azurelocal.cloud tenant (604d3138). AB#21. |
hcs-platform-mi-tpdemos-platform-client-id | MI client ID for mi-tpdemos-platform (4773d848-66b9-4940-9ca5-c724f224403b) | Platform tooling | On MI recreation | 2026-05-12 | tierpointdemos.cloud tenant (28217fed). AB#21. |
hcs-platform-mi-tppoc-platform-client-id | MI client ID for mi-tppoc-platform (185f555d-a70b-4d62-8353-fccfe86a0274) | Platform tooling | On MI recreation | 2026-05-12 | tierpointpoc.cloud tenant (2e21f99f). AB#21. |
hcs-platform-mi-tplabs-platform-client-id | MI client ID for mi-tplabs-platform (d247b73c-9863-4411-8dcd-d62f9667393b) | Platform tooling | On MI recreation | 2026-05-12 | tierpointproductlabs.cloud tenant (a9b67171). AB#21. |
hcs-platform-mi-phx-platform-client-id | MI client ID for mi-phx-platform (e20a3403-2ef5-4c6b-9c5a-66e28a323d56) | Platform tooling | On MI recreation | 2026-05-12 | projectphx.cloud tenant (c9257f80). AB#21. |
hcs-platform-mi-ptlmgmt-platform-client-id | MI client ID for mi-ptlmgmt-platform (ac0d8316-dc16-4079-8f9f-bcdf5ea2de2e) | Platform tooling | On MI recreation | 2026-05-12 | prodtechlabmgmt.com tenant (3321553e). AB#21. |
42-platform-automation-spn-client-id | SPN client ID for 42-platform-automation-spn (App ID: 3a8f6c9a-be3e-48eb-92c4-e12375424c34) | Platform automation, project-42.dev tenant (76825617-409d-4777-8986-e464f35bbcd9) | 2 years (rotate with secret) | 2026-07-26 | Entra-ID-only tenant, no subscription — no MI possible, stored centrally here instead of a per-tenant vault. Created via direct Microsoft Graph calls, not Invoke-TenantIdentitySetup.ps1 (script has an unfixed tenant-context bug for subscription-less tenants). |
42-platform-automation-spn-secret | SPN client secret for 42-platform-automation-spn | Platform automation, project-42.dev tenant | 2 years | 2026-07-26 | Expires 2028-07-27. Global Admin only in tenant 42 — no Owner @ root MG (no subscription/ARM scope exists). |
gemini-api-key | Google Gemini API key for the Invoke-HCSGeminiPrompt.ps1 REST wrapper and gemini-runner agent | scripts/Invoke-HCSGeminiPrompt.ps1 (resolved at runtime via scripts/lib/HCS.KeyVault.psm1), gemini-runner agent | 90 days or on compromise | pending Phase 0b | ACTION REQUIRED: exposed key must be rotated at aistudio.google.com before storing. Do not store the old key. Never log or display the resolved value. |
hcs-gh-runner-pat | GitHub PAT for the HCS-tenant shared Linux CI runner (KEDA ACA Job, GitHub Actions). Scopes: repo (for org-scoped runner registration). | infrastructure/runners/main.bicep (KV reference), Update-RunnerRegistration.ps1, MCP get_auth_token broker | 90 days or on compromise | pending | Used by KEDA github-runner scaler + runner registration. Rotate via GitHub → Settings → Developer settings → PATs. |
hcs-gitlab-runner-token | GitLab runner registration token for the HCS-tenant shared Linux CI runner (KEDA ACA Job, GitLab CI). | infrastructure/runners/main.bicep (KV reference), Update-RunnerRegistration.ps1 | 90 days or on compromise | pending | Group-scoped registration token for tierpoint/prodtech. Rotate via GitLab → Group → Settings → CI/CD → Runners. |
hcs-bld-vm-password | Admin password for bld-01 nested Hyper-V Windows build VM (Tier 3). | Invoke-BuildOnVm.ps1, templates/scripts/Invoke-BuildOnVm.ps1, MCP get_kv_secret | On compromise / after OS reinstall | existing | VM IP: 10.10.10.10, switch: beacon-nat. |
hcs-winbuild-vm-password | Admin password for the Tier-4 quick-deploy Windows build fallback VM (vm-hcs-winbuild-eus2-01). | infrastructure/runners/modules/windows-fallback.bicep (KV reference), Deploy-Runners.ps1 -DeployWindowsFallback | On each new VM deploy or on compromise | pending | Only stored when Tier-4 VM is deployed. Rotate after each ephemeral VM teardown. |
Cryptographic keys — kv-hcs-vault-01
| Key name | Purpose | Consumers | Rotation schedule | Created | Notes |
|---|---|---|---|---|---|
hcs-vault-prospector-release-signing-key | EC P-256 Cosign key for Vault Prospector Preview release bundles | ADO Vault Prospector Release pipeline through the HCS Platform Azure service connection | 365 days or immediately on suspected compromise | 2026-07-24 | Non-exportable Key Vault key; pipeline service principal has Key Vault Crypto User at key scope only. Public key is committed in the product repository. |
Registry — kv-turnerlegacy-prod
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
ADO-PAT | ADO PAT for Turner Legacy Platform pipelines | Turner Legacy Platform CI/CD | 90 days | — | Pre-dates naming standard. Rename on next rotation. |
CLOUDFLARE-API-TOKEN | Cloudflare API token for Turner Legacy domain DNS | Turner Legacy Platform DNS management | 90 days | — | Pre-dates naming standard. |
CLOUDFLARE-ZONE-ID | Cloudflare zone ID for Turner Legacy domain | Turner Legacy Platform DNS management | On zone change | — | Pre-dates naming standard. Not sensitive. |
COSMOS-ADMIN-PASSWORD | Cosmos DB admin password for Turner Legacy Platform app | Turner Legacy Platform API | 90 days | — | Pre-dates naming standard. |
cosmos-db-connection | Cosmos DB connection string for Turner Legacy Platform app | Turner Legacy Platform API | 90 days | — | Pre-dates naming standard. |
GITHUB-APP-CLIENT-SECRET | GitHub App client secret for Turner Legacy GitHub integration | Turner Legacy Platform | 180 days | — | Pre-dates naming standard. |
GITHUB-APP-ID | GitHub App ID for Turner Legacy GitHub integration | Turner Legacy Platform | On app change | — | Pre-dates naming standard. Not sensitive. |
GITHUB-APP-PRIVATE-KEY | GitHub App private key for Turner Legacy GitHub integration | Turner Legacy Platform | 180 days | — | Pre-dates naming standard. |
storage-connection-string | Azure Storage connection string for Turner Legacy Platform | Turner Legacy Platform | 90 days | — | Pre-dates naming standard. |
tl-platform-automation-spn-client-id | SPN client ID for tl-platform-automation-spn (App ID: a7f4c522-7238-4668-8356-8d74d61ebee0) | Platform automation scripts, turnerlegacy.org tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). |
tl-platform-automation-spn-secret | SPN client secret for tl-platform-automation-spn | Platform automation scripts, turnerlegacy.org tenant | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
Registry — kv-azlmgmt-platform
Vault for azurelocal.cloud tenant (604d3138). Created 2026-05-12 as part of AB#21.
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
azl-platform-automation-spn-client-id | SPN client ID for azl-platform-automation-spn (App ID: 92cba745-be4d-45af-b2ae-f944aa976d13) | Platform automation scripts, azurelocal.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). |
azl-platform-automation-spn-secret | SPN client secret for azl-platform-automation-spn | Platform automation scripts, azurelocal.cloud tenant | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
Registry — kv-demos-platform
Vault for tierpointdemos.cloud tenant (28217fed). Located in subscription 5e04c7f2.
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
tpdemos-platform-automation-spn-client-id | SPN client ID for tpdemos-platform-automation-spn (App ID: 4e87f1ef-f114-442a-9ab6-83dd74468cf2) | Platform automation scripts, tierpointdemos.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). Also read by Invoke-GitLabVariableDistribution.ps1 for lab-environments and azl-conference-demos group vars. |
tpdemos-platform-automation-spn-secret | SPN client secret for tpdemos-platform-automation-spn | Platform automation scripts, GitLab CI/CD group vars | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
Registry — kv-tppoc-platform
Vault for tierpointpoc.cloud tenant (2e21f99f). Created 2026-05-12 as part of AB#21.
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
tppoc-platform-automation-spn-client-id | SPN client ID for tppoc-platform-automation-spn (App ID: 1c34b4bf-c86d-4ffc-882c-bfe1ef9396d9) | Platform automation scripts, tierpointpoc.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). Read by Invoke-GitLabVariableDistribution.ps1 for tierpointpoc project vars. |
tppoc-platform-automation-spn-secret | SPN client secret for tppoc-platform-automation-spn | Platform automation scripts, GitLab CI/CD project vars | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
Registry — kv-tplabs-platform
Vault for tierpointproductlabs.cloud tenant (a9b67171). Located in subscription 2caa0b8a.
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
tplabs-platform-automation-spn-client-id | SPN client ID for tplabs-platform-automation-spn (App ID: fc07570b-f97d-41c3-a1d9-1de106503084) | Platform automation scripts, tierpointproductlabs.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). Read by Invoke-GitLabVariableDistribution.ps1 for tierpointproductlabs project vars. |
tplabs-platform-automation-spn-secret | SPN client secret for tplabs-platform-automation-spn | Platform automation scripts, GitLab CI/CD project vars | 1 year | 2026-05-12 | Expires 2027-05-11. KV_SP_SECRET set unmasked in GitLab — secret contains chars incompatible with GitLab masking. |
Registry — kv-phx-platform
Vault for projectphx.cloud tenant (c9257f80). Located in subscription 2f075d7e.
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
phx-platform-automation-spn-client-id | SPN client ID for phx-platform-automation-spn (App ID: e1953212-8a75-49ee-a031-3f7225560cd7) | Platform automation scripts, projectphx.cloud tenant | 1 year (rotate with secret) | 2026-05-12 | Created via Invoke-TenantIdentitySetup.ps1 (AB#21). Read by Invoke-GitLabVariableDistribution.ps1 for projectphx project vars. |
phx-platform-automation-spn-secret | SPN client secret for phx-platform-automation-spn | Platform automation scripts, GitLab CI/CD project vars | 1 year | 2026-05-12 | Expires 2027-05-11. Rotate before expiry. |
Registry — kv-ptlmgmt-platform
Vault for prodtechlabmgmt.com tenant (3321553e).
| Secret name | Purpose | Consumers | Rotation schedule | Last rotated | Notes |
|---|---|---|---|---|---|
ptlmgmt-platform-automation-spn-client-id | SPN client ID for ptlmgmt-platform-automation-spn | Platform automation scripts, prodtechlabmgmt.com tenant | 90-day KV version review | 2026-09-16 | Current KV version is BOM-free, tagged and expiring; the older malformed version remains recoverable. No GitLab CI copy remains in the retired haas group. |
ptlmgmt-platform-automation-spn-secret | SPN client secret for ptlmgmt-platform-automation-spn | Platform automation scripts only | 90-day KV version review | 2026-09-16 | Current KV version authenticates verbatim to Entra; the unmasked haas GitLab variable was deleted 2026-09-17. The underlying Entra credential was not rotated. |
tp-platform-aws-ec2-mac-build-username | macOS Screen Sharing login name | ProdTech EC2 Mac operator | 365 days or on host-account change | 2026-08-07 | Paired with tp-platform-aws-ec2-mac-build-password; created by Enable-AwsMacRemoteDesktop.ps1. |
tp-platform-aws-ec2-mac-build-password | Generated macOS Screen Sharing password | ProdTech EC2 Mac operator | 365 days or on host-account change | 2026-08-07 | Never committed or sent through SSM command history; applied over SSH standard input through SSM. |
Deleted / revoked secrets
| Secret name | Vault | Deleted on | Reason |
|---|---|---|---|
hcs-platform-github-kjt-godmode-pat | kv-hcs-vault-01 | 2026-05-11 | Superseded by hcs-platform-app installation tokens |
github-pat-classic-all-orgs | kv-hcs-vault-01 | 2026-05-11 | Old non-standard name, superseded |
github-pat-azurelocal-project-labels | kv-hcs-vault-01 | 2026-05-11 | Old one-off PAT, no longer needed |
github-azurelocalcloud-vscode-access | kv-hcs-vault-01 | 2026-05-11 | Old VS Code token, non-standard name |
vscode-all-orgs-godmode | kv-hcs-vault-01 | 2026-05-11 | Old god-mode token, superseded |
hybridcloud-kris-password | kv-hcs-vault-01 | 2026-05-11 | Old non-standard personal cred |
hybridcloud-kris-username | kv-hcs-vault-01 | 2026-05-11 | Old non-standard personal cred |
platform-docs-swa-deploy-token | kv-hcs-vault-01 | 2026-05-11 | Renamed to hcs-platform-swa-docs-deploy-token |
hcs-prd-cloudflare-api-token | kv-hcs-vault-01 | 2026-05-11 | Renamed to hcs-platform-cloudflare-api-token |
hcs-prd-ado-platform-pat | kv-hcs-vault-01 | 2026-05-11 | Renamed to hcs-platform-ado-platform-pat |
hcs-prd-azure-sub-id | kv-hcs-vault-01 | 2026-05-11 | Renamed to hcs-platform-azure-sub-id |
hcs-prd-github-org-pat | kv-hcs-vault-01 | 2026-05-11 | Renamed to hcs-platform-github-org-pat |
hcs-platform-github-kjt-password | kv-hcs-vault-01 | 2026-05-09 | Renamed per AB#20 naming standard |
hcs-platform-entra-hcs-password | kv-hcs-vault-01 | 2026-05-09 | Renamed per AB#20 naming standard |
hcs-platform-entra-azl-password | kv-hcs-vault-01 | 2026-05-09 | Renamed per AB#20 naming standard |
Vault access
Access to each vault is controlled by Azure RBAC. Minimum roles:
| Role | Capability |
|---|---|
Key Vault Secrets User | Read secrets |
Key Vault Secrets Officer | Create and update secrets |
The platform managed identity has cross-vault read access. See managed-identities.md.