Configuring available secrets for a workspace

A database might need to connect to external domains. For example, a workflow might need access to an external domain in order to complete its tasks. Or you might want to write output to an S3 bucket or to Azure Blob Storage.

You configure the available domains in your account settings. For more information, go to Managing allowed domains for an account.

In your workspace, you configure the secrets to use to connect to those domains. If the same domain is connected to from multiple workspaces, then you must configure the secrets in each workspace.

You configure the secrets in the Secrets section of the workspace settings page.

Secrets section of the workspace settings page

Adding a secret

To add a secret to a workspace, click Add Secret.

Setting the secret type and name

On the Add Secret panel:

Add Secret panel to add a secret to the list

1. From the Type dropdown list, select the type of secret to create. A secret can be either a local value, or a secret from AWS Secrets Manager.

2. In the Name field, provide the name of the secret. The name can only contain letters, numbers, and underscores. After you save the secret, you cannot change the name.

Providing the value for a local value secret

For a local value secret, in the Value field, provide the text of the secret value.

Configuring an AWS Secrets Manager secret

For an AWS Secrets Manager secret:

Add Secret panel to add an AWS Secrets Manager secret

1. From the AWS Role dropdown list, select the role to use to retrieve the secret. The dropdown list contains the available AWS roles for the workspace. The role must have read access (secretsmanager:GetSecretValue) to the secret.

2. In the Secret name or ARN field, provide either the Amazon Resource Name (ARN) or the name of the secret.

3. Optionally, in the JSON attribute field, provide the identifier of a JSON attribute to extract from a JSON secret.

Setting the allowed domains for the secret

Under Allowed Domains, provide the list of domains to use the secret to connect to.

Place each domain on a separate line.

The domains must be configured and verified in the account settings.

Saving the secret

To save the secret and add it to the list, click Save.

Editing a secret

After you add a secret, you can change the secret and the domains that it can be used for.

You cannot change the secret name.

To edit a secret:

1. In the Secrets list, click the Edit option for the secret.

2. On the details panel, provide the updated configuration.

3. Click Save.

Removing a secret

To remove a secret, in the Secrets list, click the Delete option for the secret.

About secrets to connect to Amazon S3

To connect to Amazon S3, you configure the following secrets:

• AWS_ACCESS_KEY_ID

• AWS_SECRET_ACCESS_KEY

For both secrets, you add the Amazon S3 domain that you configured for the account.

About secrets to connect to Azure Blob Storage

To connect to Azure Blob Storage, you can provide either:

• AZURE_STORAGE_KEY - An account key. How to find an account key.

• AZURE_STORAGE_SAS_TOKEN - A SAS token. How to generate a SAS token.

Fabricate does not support Microsoft Entra ID authentication.

For either type of secret, you add the Azure Blob Storage domain that you configured for the account.