Secret

A Secret stores sensitive values such as API keys, database passwords, or tokens. Secrets are encrypted at rest in Kyku state (AES-256-GCM with PBKDF2) and stored in the provider’s secrets manager. On AWS this is Secrets Manager, on GCP Secret Manager. Hetzner and DigitalOcean have limited or no native secrets management.

Config

Property	Type	Required	Description
name	string	yes	Unique resource name
id	string	no	Explicit ID (auto-generated UUID if omitted)
provider	string	no	Provider label for multi-provider configs
tags	Record<string, string>	no	Arbitrary key-value metadata
value	string	yes	Secret value (encrypted in state)

Example

import { Secret } from '@kykucloud/types'

const apiKey = new Secret({
  name: 'stripe-api-key',
  value: 'sk_live_abc123…',
})

Provider Support

Provider	Supported	Backend
AWS	✅	Secrets Manager
GCP	✅	Secret Manager
Hetzner	❌	Not available
DigitalOcean	❌	Not available

Notes

• Encryption: Value is encrypted with AES-256-GCM in Kyku state before storage. Decrypted only during the apply phase.
• Rotation: AWS Secrets Manager supports automatic rotation via rotationPeriod. Configure via provider-specific settings.
• Access: Secrets can be referenced from Database.password using Secret<string> type.