--- name: framework-financial-services-shared-secrets title: Handling and securing secrets description: A secret is any piece of data that is sensitive within the context of an application or service. Secrets must be securely protected through their entire lifecycle. last-updated: 2025-03-02 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/framework-financial-services?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Handling and securing secrets {: #shared-secrets} A secret is any piece of data that is sensitive within the context of an application or service. Secrets must be securely protected through their entire lifecycle. {: shortdesc} Secrets include all of the following but are not limited to: * Passwords of any type (database logins, OS accounts, functional IDs, and so on) * API keys * Long-lived authentication tokens (OAuth2, GitHub, IAM, and so on) * SSH keys * Encryption keys * Other private keys (PKI/TLS certificates, HMAC keys, signing keys, and so on) Application providers should ensure: * Secrets are generated and stored in the environment (for example, dev, test, and production) where your service is deployed. * Secrets never leave their environments (for example, dev, test, and production) and should be secured by using access control measures. Service design should minimize the number of machines and people with access to secrets by using both authorization and network restrictions based on the principle of least privilege. * Secrets are rotated in according with the requirements of the IBM Cloud Framework for Financial Services with minimal or no downtime. * Secrets are never stored in source code, configuration files, or documentation. The following table lists the different solutions that you can use to protect your application secrets. | Scenario | What to use | | --- | --- | | You need to create, lease, and manage API keys, credentials, database configurations, and other secrets for your services and applications. | Use [IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started&format=markdown). | | You need to generate, renew, and manage TLS/SSL certificates for your deployments. | Use [IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started&format=markdown). | | You need to create and manage encryption keys. | Use [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-overview&format=markdown) to manage encryption keys in a single-tenant service with dedicated hardware. | | You need secrets in your Red Hat OpenShift on IBM Cloud environment for microservices to connect to system resources. | Use [Kubernetes secrets](https://kubernetes.io/docs/concepts/configuration/secret/){: external} encrypted using [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/openshift?topic=openshift-encryption&format=markdown#keyprotect) as your Key Management Service (KMS) provider. | {: caption="Secrets management and data protection scenarios" caption-side="top"} [^tabletext-1]: Generally speaking, you should strive to use only services which are Financial Services Validated in your solutions. However, depending on your circumstance there may be exceptions. See the best practice [Use only services that are IBM Cloud for Financial Services Validated](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices&format=markdown#best-practices-financial-services-validated-services) for more details and potential exceptions. {: important} [^tabletext-2]: Generally speaking, you should strive to use only services which are Financial Services Validated in your solutions. However, depending on your circumstance there may be exceptions. See the best practice [Use only services that are IBM Cloud for Financial Services Validated](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices&format=markdown#best-practices-financial-services-validated-services) for more details and potential exceptions. {: important} ## Related controls in IBM Cloud Framework for Financial Services {: #related-controls} {{site.data.content.related-controls-disclaimer}} | Family | Control | |---------------------|---------------------------------------------------| | Access Control (AC) | [AC-2 Account Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-2&format=markdown) | | Identification and Authentication (IA) | [IA-2 Identification and Authentication (organizational Users)](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-2&format=markdown) \n [IA-5 Authenticator Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ia-5&format=markdown) | {: caption="Related controls in IBM Cloud Framework for Financial Services [FSv2.0]" caption-side="top"} {: #related-controls-fsv2.0} {: tab-title="FSv2.0"} {: tab-group="RelatedControls-1"} {: class="simple-tab-table"} | Family | Control | |---------------------|---------------------------------------------------| | Access Control (AC) | [AC-2 Account Management](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-ac-2&format=markdown) | | Identification and Authentication (IA) | [IA-2 User Identification and Authentication](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-ia-2&format=markdown) \n [IA-5 Authenticator Management](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-ia-5&format=markdown) | {: caption="Related controls in IBM Cloud Framework for Financial Services [FSv1.1]" caption-side="top"} {: #related-controls-fsv1.1} {: tab-title="FSv1.1"} {: tab-group="RelatedControls-1"} {: class="simple-tab-table"} ## Next steps {: #next-steps} * [Consumer accounts for application provider workloads](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-consumer&format=markdown)