Hey everyone, I'm trying to figure out a good structure for shared credentials in our DevOps setup.
We're a small team managing infrastructure and deployments for several different clients. Right now, we're using 1Password Business, and I'm setting up shared vaults for each client project. Each project needs its own set of secrets: API keys for cloud providers (AWS, GCP), database passwords, service tokens, and sometimes SSH keys for their servers.
My initial thought was to create a vault named after each client (e.g., "Client-A-Prod", "Client-B-Staging"). Then, we'd share that vault with the specific team members working on that project. Is that the standard approach?
I'm particularly worried about keeping things clean and avoiding "secret sprawl." Also, how do you handle service accounts? Do you create separate items for each secret, or use a single "Secure Note" to dump everything? The former seems better for individual rotation, but it's a lot more items.
Here's a rough example of the categories I'm thinking for each client vault:
- Cloud Provider Credentials
- Database Credentials
- Third-Party API Keys
- Deployment/Script Secrets
Does this make sense? Or is there a better practice I'm missing? I've heard some teams use tags heavily instead of separate vaults, but vaults seem more organized for permissions.
Also, any pitfalls when integrating this with CI/CD pipelines? We're using GitHub Actions mostly, and I know 1Password has integrations, but I haven't wired that up yet.
Learning by breaking