Secrets and secret definitions

A secret in is a pointer to a secure location where a value is stored. A secret definition can represent a password or secure API access token.

To create a secret definition, follow the process given in Connections and select Generic secret as the provider type.

In a Hybrid SaaS deployment, you are responsible for managing your own AWS Secrets Manager or Azure Key Vault in your own cloud infrastructure.

---

Adding a secret to the AWS Secrets Manager

1. Log in to the AWS account that houses your .
2. Browse to the Secrets Manager service.
3. Ensure you’re in the same AWS region as your .
4. Click Store a new secret.
5. Click Other type of secret.
6. Enter a memorable key name and then your secret’s value as the value.
7. Click Next until the secret creation is completed.

---

Adding a secret to Azure Key Vault

1. Log in to the Azure portal.

2. Click Key vaults and click the name of the key vault you want to reference. If there is only one, then this will be the [Default] key vault configured in the .

3. Click Objects and then click Secrets.

4. Click + Generate/Import.

5. On the Create a secret screen enter the following:

   Property	Description
   Upload options	Select Manual.
   Name	Type a name for the secret. The secret name must be unique within a key vault. The name must be a 1-127 character string, starting with a letter and containing only 0-9, a-z, A-Z, and -. For more information on naming, read Key Vault objects, identifiers, and versioning.
   Secret value	Type a value for the secret.

6. Click Create.

---

Adding a Snowflake private key

When creating an environment for a Snowflake data warehouse, you can choose to use key-pair authentication. With this authentication method, the private key will be stored as a secret.

Read Using Snowflake key-pair authentication to learn more.

The guidance above applies specifically to environment-level Snowflake connections, where the private key is stored as a plaintext secret (in Matillion’s managed vault, AWS Secrets Manager, Azure Key Vault, or a Snowflake schema, depending on your deployment model). Components such as Database Query, JDBC Table Metadata to Grid, and Bash Pushdown use a different pattern: key/value JSON secrets with escaped newlines (\n). Refer to the individual component documentation for details.