Skip to main content

Customer Secret Management

This page defines the required naming format and permissions when customers create and manage AWS Secrets Manager secrets in their own namespace(s).

This is a CAIP naming requirement. It is intentionally not tied to Kubernetes Secret resource naming, nor to any specific external secret manager.

Permissions (create/update/delete)​

  • Permissions for AWS Secrets Manager secret operations (create/update/getvalue/putvalue) are granted to two IAM roles: CD4ML and caip-developer.
    • Customers can assume either role depending on their needs, then operate on AWS Secrets Manager secrets accordingly.
  • Customers can create and update secrets within their own namespace.
  • Customers do not have permission to delete secrets.
  • If a secret must be deleted, please contact Orbit L2 to perform the deletion, and include the secret name and secret ARN in your request.

Required format​

All secrets MUST be created using the following name format:

/<product_name>/<namespace>/<env>/<region>/<secret_name>

Segment definitions​

  • <product_name>: Product identifier.
  • <namespace>: The namespace where the secret is intended to be used.
    • Must match your target namespace name.
  • <env>: Environment name, for example prod.
  • <region>: AWS region where the namespace is running, for example eu-central-1, us-east-1, or cn-north-1.
  • <secret_name>: Customer-defined suffix.
    • Choose a meaningful suffix that makes the secret easy to identify (purpose, component, environment, etc.).

product_name mapping (Managed Kubeflow)​

Use the following value for <product_name> depending on your environment:

RegionEnvironment<product_name>
CNManaged Kubeflow prodmcaip-cn
ROWManaged Kubeflow prodmcaip-kflw

Examples​

CN​

  • /mcaip-cn/ai-hworld/prod/cn-north-1/model-registry

ROW​

  • /mcaip-kflw/hal9000/prod/eu-central-1/inference-basic-auth

Rules and recommendations​

  • The full name must start with /.
  • The <product_name>, <namespace>, <env>, and <region> segments must match the target Managed Kubeflow environment.
  • Keep naming consistent across namespaces.
  • Avoid embedding sensitive data in the name.

Common mistakes​

  • Missing leading slash: product/ns/prod/region/...
  • Using a different namespace in the name than where you plan to use it
  • Using the wrong environment or region segment
  • Reusing the same name for different purposes in the same namespace