Credential sources
Let agents resolve database passwords from HashiCorp Vault or AWS Secrets Manager, so Relay does not store them.
A credential source is an external secret store your agents read database passwords from. A connection then names a secret instead of saving a password in Relay.
For connections that use a credential source, the agent reads the password from the source at connect time and Relay does not store it. Relay keeps only the reference to a secret, never the secret value. Connections created with Store in Relay do not use a credential source: their password is stored encrypted (see Connections).
Supported sources
- HashiCorp Vault — configure the address (required), role (required), and
optionally an auth path, namespace, and CA certificate. The agent logs in with
Vault's Kubernetes auth method (default mount
auth/kubernetes), so Vault must trust the agent's service account. - AWS Secrets Manager — configure the region (required), and optionally a role ARN and endpoint. The agent authenticates with web identity (for example IRSA on EKS), so it needs a web identity token and role available.
Who can read the configuration
Anyone who can see a source sees that its configuration is set, but only users with permission to update credential sources can read the configuration back. When you edit a source, a field is sent only if you actually change it, so re-saving other fields never blanks a value you were not shown.
Using a source on a connection
On a connection, choose Agent resolves it, pick the source, and give a
reference to the secret (e.g. secret/data/prod#password). The agent resolves the
password at connect time.
Deleting a credential source is refused while any connection still resolves through it. Repoint or remove those connections first.