This article is based on a press release originally published by Thycotic via PR Newswire on May 22, 2020.
Overview
Thycotic, a provider of privileged access management (PAM) solutions, announced an update to its DevOps Secrets Vault product that introduces dynamic secrets and just-in-time (JIT) access for major infrastructure-as-a-service (IaaS) platforms: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). The release targets a growing challenge in modern DevOps environments — the secure management of short-lived credentials across complex, multi-cloud pipelines.
The Problem: Secrets Sprawl in Multi-Cloud Environments
As organizations move workloads to cloud IaaS platforms, the DevOps toolchains managing those workloads grow in complexity. A typical pipeline may combine open-source and commercial tools, numerous plug-ins, and library dependencies. Each integration point is a potential surface for secrets leakage — credentials may be improperly stored in memory, written to disk, sent to logging systems, or inadvertently exposed to third-party tools or processes.
Long-lived static credentials compound this risk. If a secret is exfiltrated and remains valid indefinitely, an attacker has a persistent foothold in the environment. Reducing secret lifetime is one of the most effective controls available to security teams.
What Are Dynamic Secrets?
Dynamic secrets are credentials that are generated on demand at the time of a request, rather than stored statically and retrieved when needed. Key characteristics include:
- Ephemeral by design: Each secret is valid only for a defined time window and is automatically revoked after expiry.
- Least-privilege scoping: Secrets are issued with cloud IAM policies that restrict what the credential can access, limiting the blast radius if compromised.
- Just-in-time provisioning: A user, pipeline agent, or configuration tool receives a credential only when it actually needs one, not before.
- Auditability: Because each secret is unique and time-bound, it is straightforward to tie access events to specific requests in audit logs.
In Thycotic DevOps Secrets Vault, dynamic secrets can be issued for AWS, Azure, and GCP, leveraging each platform’s native IAM and policy mechanisms to enforce fine-grained authorization.
Why Just-in-Time Access Matters for DevOps
Traditional PAM solutions were designed around human users and long-lived service accounts. DevOps pipelines operate differently: automation runs continuously, workloads scale elastically, and secrets may be consumed by hundreds of ephemeral containers or CI/CD job runners simultaneously. Static secrets issued to these processes are difficult to rotate and easy to lose track of.
JIT access addresses this by ensuring that no standing privilege exists. A pipeline stage requests a credential, performs its task, and the credential expires automatically. Even if the secret is captured in a log or intercepted in transit, its short validity window significantly reduces its value to an attacker.
“With dynamic secrets, we have added a just-in-time approach to secrets management that further reduces the risk of compromised credentials.”
Jai Dargan, Vice President of Product Management, Thycotic
Platform and Tool Integrations
DevOps Secrets Vault is built on AWS infrastructure, providing elastic scalability suited to high-throughput secrets management workloads. At the time of this release, integrations and SDK support included:
CI/CD and Configuration Management
- Jenkins
- Ansible
- Terraform
- Kubernetes
- Chef (newly added in this release)
- Puppet (newly added in this release)
SDKs
- Java
- Go
- Python
- Ruby (newly added in this release)
- .NET (newly added in this release)
Authentication Methods
DevOps Secrets Vault supports multiple authentication methods, allowing teams to integrate with their existing identity infrastructure:
- AWS: IAM-based authentication for AWS workloads and services.
- Azure: Azure AD-based authentication for Azure-hosted resources.
- GCP: Supports authentication via GCP service accounts, user accounts, Google Compute Engine (GCE) instances, and Google Kubernetes Engine (GKE) workloads.
- Thycotic One: Thycotic’s own identity provider, offering single sign-on (SSO) and two-factor authentication via TOTP (time-based one-time passwords) and SMS.
Positioning Within a Secrets Management Strategy
Dynamic secrets are one layer of a broader secrets management strategy. Organizations implementing JIT access for cloud platforms should also consider:
- Centralized secrets storage: A single vault reduces the sprawl of secrets across config files, environment variables, and code repositories.
- Secrets rotation policies: For secrets that cannot be made fully dynamic, automated rotation limits exposure windows.
- Audit logging and alerting: Every secrets access event should be logged and anomalous patterns should trigger alerts.
- Shift-left secret scanning: Integrating secret detection into source control and CI pipelines catches accidental commits before they reach production.
- Least-privilege IAM policies: Dynamic secrets are only as secure as the policies scoping them — overly broad policies undermine the JIT benefit.
About Thycotic
At the time of this announcement, Thycotic was headquartered in Washington, DC, with offices in the UK and Australia, and served over 10,000 organizations globally. Note: Thycotic merged with Centrify in 2021 to form Delinea. Product names, features, and company details may have changed since this announcement.