SecretZero/examples/compliance.yml at main · zloeber/SecretZero · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
# Example: Compliance-Driven Secret Management
# Demonstrates SOC2 and ISO27001 compliance with strict policies


metadata:
  project: compliance-demo
  owner: compliance-team
  compliance:
    - soc2      # Automatically adds soc2_rotation policy
    - iso27001  # Automatically adds iso27001_rotation policy

variables:
  environment: production

providers:
  aws:
    auth:
      kind: ambient

# Custom compliance policies
policies:
  # Identity guardrail: only allow syncs when AWS identity is in approved region.
  aws_region_guard:
    kind: provider_identity
    providers:
      - aws
    match: all
    rules:
      - field: region
        glob: us-east-1

  # Strict rotation requirements
  critical_rotation:
    kind: rotation
    require_rotation_period: true
    max_age: 60d
    severity: error
    enabled: true

  # Access control for compliance
  compliance_targets:
    kind: access
    allowed_targets:
      - ssm_parameter
      - secrets_manager
      - vault_kv
    denied_targets:
      - file  # No local files in compliance mode
    severity: error
    enabled: true

secrets:
  # Critical system password - 60 day rotation
  - name: critical_system_password
    kind: random_password
    rotation_period: 60d
    config:
      length: 32
      special: true
    targets:
      - provider: aws
        kind: secrets_manager
        config:
          name: /critical/system-password

  # Standard application secret - 60 day rotation (within compliance)
  - name: app_secret
    kind: random_password
    rotation_period: 60d
    config:
      length: 32
    targets:
      - provider: aws
        kind: ssm_parameter
        config:
          name: /app/secret
          type: SecureString

# Usage:
# 1. Check compliance:
#    secretzero policy -f compliance.yml --fail-on-warning
#
# 2. Sync secrets:
#    secretzero sync -f compliance.yml
#
# 3. Regular rotation check (in CI/CD):
#    secretzero rotate -f compliance.yml --dry-run
#    # Exit with error if any secrets need rotation