Secure Secret Manager authentication

The Secret Manager managed service includes security mechanisms to protect access to secrets. This page presents the best practices for securing authentication, particularly in a SecNumCloud compliance context.

Secure TLS connections

Communications with the Secret Manager are encrypted with TLS (Transport Layer Security). The instance is accessible via its host over HTTPS.

Verify TLS encryption

curl -v https://{instance-host}/v1/sys/health

Strong authentication and SecNumCloud compliance

To meet the SecNumCloud strong authentication requirements, combine several layers of security following a multi-factor approach.

Recommended multi-factor architecture

Factor	Mechanism	Protection
Something you know	Secret Manager access credentials	Application-level authentication
Something you have	VPN with MFA	Network layer
Something you are	Network access control (IP, VPC)	Security perimeter

Recommended configuration for sensitive environments

1. IP restriction: Restrict access to the authorized IP address ranges;

2. Access via VPN with MFA: Connect to the Secret Manager through a VPN with MFA authentication to add a network security layer;

3. Bastion with MFA: Deploy a bastion with strong authentication (TOTP, hardware key) and configure access to the Secret Manager only through this bastion;

4. Principle of least privilege: Grant only the permissions required to access the secrets.

Typical architecture

[Application/User] 
    → [VPN with MFA] 
    → [Bastion/Proxy] 
    → [Secret Manager]

Access control

Numspot IAM permissions

Access to Secret Manager instance management operations is controlled by IAM (Identity and Access Management) permissions:

Permission	Description
secrets.instance.get	Retrieve the information of an instance or list the instances
secrets.instance.create	Create an instance
secrets.instance.delete	Delete an instance

Application-level access control

Access control for secrets within the instance is managed by the internal mechanisms of the Secret Manager. For more information on configuring application-level access, refer to the documentation of the instance interface.

Access auditing

Instance management events

Instance management operations (creation, viewing, deletion) are logged by the Numspot API.

Auditing secret access

Logging of secret access is managed by the internal mechanisms of the Secret Manager. To configure and view the audit logs, refer to the documentation of the instance interface.

Protection against attacks

Attempt limiting

Protections against brute-force attacks are applied:

• temporary lockout after repeated failures;
• rate limiting on sensitive operations.

Anomaly detection

Monitor suspicious behavior in the audit logs:

• multiple connection failures;
• access to secrets from unusual IP addresses;
• unauthorized access attempts.

Summary of SecNumCloud best practices

Requirement	Recommended implementation
Connection encryption	Mandatory TLS (HTTPS)
Strong authentication	VPN with MFA + Secret Manager credentials
Access control	Restrictive IAM permissions, principle of least privilege
Access auditing	Audit logs enabled, regular review
Revocation	Immediate deletion or revocation in case of compromise

tip

For critical architectures, use an SSH bastion or an access proxy to centralize and audit all connections to the Secret Manager. Set up a quarterly access review.