Frostmoln Docs

English

Svenska
Suomi
Norsk

English

Svenska
Suomi
Norsk

Appearance

Secrets ​

Frostmoln Secrets is a managed key-value store for your application secrets — API keys, credentials, connection strings, and configuration. Values are stored in a dedicated, isolated Vault (separate from Frostmoln's own infrastructure secrets), encrypted at rest, and visible only to your tenant.

Store a secret ​

Under Secrets → Create, give the secret a name and a value. A secret holds a single value (plain text or JSON) plus metadata:

  • Content type — text/plain (default) or application/json (validated).
  • Description and tags for organization.
  • Max versions — how many historical versions to retain (1–100, default 10).
  • Recovery window — days a deleted secret can be recovered (0–30, default 7).
bash
fm secrets create --name app/db-password --value 's3cr3t' \
  --description "Production DB password" --tags env=prod

fm secrets get app/db-password --show-value
fm secrets list
hcl
resource "frostmoln_secret" "db_password" {
  name         = "app/db-password"
  secret_value = var.db_password
  content_type = "text/plain"
  max_versions = 10
  tags         = { env = "prod" }
}

In Terraform the value is marked sensitive (kept out of plan output). A frostmoln_secret data source lets you read a secret's metadata by ID.

Versioning ​

Every update creates a new version while retaining history (up to max versions). Read the latest by default, or a specific version:

bash
fm secrets versions app/db-password
fm secrets get-version app/db-password 3 --show-value

To roll back, read the older version's value and write it as a new update.

Delete and recover ​

Deleting a secret is a soft delete — it enters a pending-deletion state for the recovery window, during which you can restore it:

bash
fm secrets delete app/db-password      # soft-delete
fm secrets recover app/db-password     # restore within the recovery window

After the window passes, the secret is permanently removed.

Good practice ​

  • Reference secrets from your application at runtime rather than baking them into images or source control.
  • Use tags to group secrets by service or environment.

Limits ​

  • Values up to ~64 KB; content types are text or JSON (no binary).
  • The secret name is fixed after creation (value, description, and tags are updatable).
  • Automatic rotation and dynamic (generated) secrets are not yet available.