Secrets management

There are three ways to provide the required credentials to TruffleHog:

You can provide URIs to the scanner to indicate that it should retrieve the local configuration from different sources.

For example,

AWS Secrets Manager secrets are expected to contain the Plaintext yaml config file, and are specified with this schema to the --config flag:

Check out the AWS Secret Manager documentation for more information on using that product.

Google Secrets Manager secrets are expected to contain the yaml config file, and are specified with this schema to the --config flag:

Check out the GCP Secret Manager documentation for more information on using that product.

Azure Key Vault secrets are expected to contain the YAML config file, and are specified with this schema to the --config flag:

Check out the Azure Key Vault documentation for more information on using that product.

You can specify your configuration directly in a file. Environment variables in the form $VARIABLE and ${VARIABLE} found in the file will be expanded at runtime.

Using environment variables can provide the bare-minimum configuration so that TruffleHog can connect to the API. If you’d like to use environment variables within a config file, see the above Config flag with a file section