Configuring available secrets for a workspace

A database might need to connect to external domains. For example, a workflow might need access to an external domain in order to complete its tasks. Or you might want to write output to an S3 bucket or to Azure Blob Storage.

You configure the available domains in your account settings. For more information, go to Managing allowed domains for an account.

In your workspace, you configure the secrets to use to connect to those domains. If the same domain is connected to from multiple workspaces, then you must configure the secrets in each workspace.

You configure the secrets in the Secrets section of the workspace settings page.

Secrets section of the workspace settings page

Adding a secret

To add a secret to a workspace:

1. Click Add Secret.

Add Secret panel to add a secret to the list

1. In the Name field, provide the name of the secret. The name can only contain letters, numbers, and underscores. After you save the secret, you cannot change the name.
2. In the Secret field, provide the text of the secret.
3. Under Allowed Domains, provide the list of domains to use the secret to connect to. Place each domain on a separate line. The domains must be configured and verified in the account settings.
4. Click Save.

Editing a secret

After you add a secret, you can change the secret and the domains that it can be used for.

You cannot change the secret name.

To edit a secret:

1. In the Secrets list, click the Edit option for the secret.
2. On the details panel, you can:

   • Change the text of the secret.
   • Change the domains. The domains must be configured and verified in the account settings.
3. Click Save.

Removing a secret

To remove a secret, in the Secrets list, click the Delete option for the secret.

About secrets to connect to Amazon S3

To connect to Amazon S3, you configure the following secrets:

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY

For both secrets, you add the Amazon S3 domain that you configured for the account.

About secrets to connect to Azure Blob Storage

To connect to Azure Blob Storage, you can provide either:

• AZURE_STORAGE_KEY - An account key. How to find an account key.
• AZURE_STORAGE_SAS_TOKEN - A SAS token. How to generate a SAS token.

Fabricate does not support Microsoft Entra ID authentication.

For either type of secret, you add the Azure Blob Storage domain that you configured for the account.