Secret stores
The following table lists secret stores supported by the Dapr secrets building block. Learn how to set up different secret stores for Dapr secrets management.
Table headers to note:
| Header | Description | Example |
|---|---|---|
| Status | Component certification status | Alpha Beta Stable |
| Component version | The version of the component | v1 |
| Since runtime version | The version of the Dapr runtime when the component status was set or updated | 1.11 |
Alibaba Cloud
| Component | Multiple Key-Values Per Secret | Status | Component version | Since runtime version |
|---|---|---|---|---|
| AlibabaCloud OOS Parameter Store |  | Alpha | v1 | 1.6 |
Amazon Web Services (AWS)
| Component | Multiple Key-Values Per Secret | Status | Component version | Since runtime version |
|---|---|---|---|---|
| AWS Secrets Manager | ✅ | Beta | v1 | 1.15 |
| AWS SSM Parameter Store | | Alpha | v1 | 1.1 |
Generic
| Component | Multiple Key-Values Per Secret | Status | Component version | Since runtime version |
|---|---|---|---|---|
| HashiCorp Vault | ✅ | Stable | v1 | 1.10 |
| Kubernetes secrets | ✅ | Stable | v1 | 1.0 |
| Local environment variables | | Stable | v1 | 1.9 |
| Local file | ✅ | Stable | v1 | 1.9 |
| OpenBao | ✅ | Stable | v1 | 1.16 |
Google Cloud Platform (GCP)
| Component | Multiple Key-Values Per Secret | Status | Component version | Since runtime version |
|---|---|---|---|---|
| GCP Secret Manager | | Alpha | v1 | 1.0 |
HuaweiCloud Cloud
| Component | Multiple Key-Values Per Secret | Status | Component version | Since runtime version |
|---|---|---|---|---|
| HuaweiCloud Cloud Secret Management Service (CSMS) | | Alpha | v1 | 1.8 |
Microsoft Azure
| Component | Multiple Key-Values Per Secret | Status | Component version | Since runtime version |
|---|---|---|---|---|
| Azure Key Vault | | Stable | v1 | 1.0 |
Tencent Cloud
| Component | Multiple Key-Values Per Secret | Status | Component version | Since runtime version |
|---|---|---|---|---|
| Tencent Cloud Secrets Manager (SSM) | | Alpha | v1 | 1.9 |
Multiple key-values per secret
The Multiple Key-Values Per Secret column in the tables above indicates whether the secret store can return multiple key-value pairs from a single secret.
When a secret store supports multiple key-values per secret (✅), retrieving a secret returns a JSON object with the keys stored in that secret as fields. The secret name is not part of the response. For example, retrieving the db-secret secret from a Kubernetes secret store returns:
{
"key1": "value1",
"key2": "value2"
}
When a secret store does not support multiple key-values per secret (empty box), the secret store has name/value semantics: retrieving a secret returns a JSON object with a single field, where the field name is the secret name and the value is the secret value. For example, retrieving the same db-secret secret returns:
{
"db-secret": "value1"
}
Some secret stores let you choose between the two behaviors through a component metadata field, such as multipleKeyValuesPerSecret for AWS Secrets Manager, multiValued for the local file secret store, and vaultValueType for HashiCorp Vault. See the secrets API reference for more details on the response format.