# Universal Secrets Sync Basics ### Overview **Universal Secrets Sync** empowers enterprises to unify and automate their secrets management across cloud environments. Keeper Vault records can be synced to AWS Secrets Manager, Azure Key Vault and Google Secret Manager. Administrators can easily enable the feature, configure the sync policy and monitor activity—all within Keeper’s zero-knowledge security framework. This eliminates manual updates, reduces configuration drift, and gives Security/DevOps teams a single, trusted control plane for managing secrets at enterprise scale. ### Prerequisites Prior to using USS, make sure to have the following: * An active license of KeeperPAM * A PAM Configuration for your target cloud infrastructure (AWS, Azure, GCP) where secrets will be synced to * A Keeper Gateway and a Secrets Manager application associated with the PAM Configuration ### USS Enforcement Policies On the Admin Console, enable “Can configure universal secrets sync settings” enforcement policy to allow a user to configure universal secrets sync:
### Installing the Keeper Gateway The [Keeper Gateway](/keeperpam/privileged-access-manager/getting-started/gateways.md) is a service that is installed on the customer's network to enabled zero-trust access to target infrastructure. This service is installed on a Docker, Linux or Windows environment in each of the networks under management. ### PAM Cloud Configuration To get started with Discovery, you need a [PAM Configuration](/keeperpam/privileged-access-manager/getting-started/pam-configuration.md) set up for your target cloud infrastructure. The PAM Configuration directs the USS process where to persist secrets. In general, the USS configuration process is: * On a PAM Configuration, enable Universal Secrets Sync feature. * Select one or more shared folders to link to the PAM Configuration. All the Keeper records from these shared folder/s will be synced. * Specify a Sync Identity that Keeper Gateway can use to sync records to the cloud secrets storage. The Sync Identity should have read/write access to the secrets manager service in your cloud environment. If unspecified, the Gateway will use the access keys specified in the PAM Configuration. * If you want to allow users to preview the secrets before they are synced to the cloud, check the Dry-run option. If unchecked, universal secrets sync will automatically sync Keeper record changes to the corresponding cloud secrets. ### AWS Secrets Sync AWS secrets sync makes use of whatever AWS Role Policies have been granted to the Keeper Gateway in order to persist secrets. The PAM Configuration filters against the provided region names to explicitly specify which regions are used for secret persistence. Below is the PAM Configuration data required for a successful sync. | Field | Description | Notes | | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | | AWS ID | Identifier selected by user | This is just used for reference. | | Access Key ID | Access Key only when required | If instance role is applied to the Gateway, this is not required. | | Secret Access Key | Secret Key only when required | If instance role is applied to the Gateway, this is not required. | | Region Names | A list of AWS region names separated by newlines. USS will only sync to the Secrets Manager in these regions. |

Example:

us-west-1
us-east-2

| | Location | One or more shared folders to link to the PAM Configuration. All the Keeper records in these shared folder/s will be synced. | | | Sync Identity | Optional role that if provided Keeper Gateway will use to sync records. The Sync Identity should have read/write access to AWS Secrets Manager. If unspecified, the Gateway will use the access keys specified in the PAM Configuration. | Example: `arn:aws:iam::396302558068:role/keeper-uss-sync-role` | | Dry run | Check to allow users to preview the secrets before they are synced to the cloud. If unchecked, universal secrets sync will automatically sync Keeper record changes to the corresponding cloud secrets. | |

PAM Configuration for Universal Secrets Sync

*** ### Azure Secrets Sync Azure sync makes use of whatever permissions have been granted to the role assigned to the Keeper Gateway in order to persist secrets in Azure Key Vault. Below is the PAM Configuration data required for a successful sync.
FieldDescriptionNotes
Azure IDA unique id for your instance of AzureRequired, This is for the user's reference
Ex: Azure-1
Client IDThe application/client id (UUID) of the Azure applicationRequired
Client SecretThe client credentials secret for the Azure applicationRequired
Subscription IDThe UUID of the subscription (i.e. Pay-As-You-GO).Required
Tenant IDThe UUID of the Azure Active DirectoryRequired
Resource GroupsA list of resource groups to be checked. If left blank, all resource groups will be checked. Newlines should separate each resource group.
LocationOne or more shared folders to link to the PAM Configuration. All the Keeper records in these shared folder/s will be synced.
Sync IdentityOptional identity that if provided Keeper Gateway will use to sync records. The Sync Identity should have read/write access to Azure Key Vault. If unspecified, the Gateway will use the credentials specified in the PAM Configuration. NOTE: The gateway must be running on Azure infrastructure (VM, AKS, Azure Functions, etc.) with the specified user-assigned managed identity assigned to it. This mechanism does not work for on-premises gateways.Example: a1b2c3d4-e5f6-7890-abcd-ef1234567890
Vault NameRequired name of the Key Vault to sync secrets to. This vault gets created on the first sync if it doesn’t exist already.Example: my-vault
Dry runCheck to allow users to preview the secrets before they are synced to the cloud. If unchecked, universal secrets sync will automatically sync Keeper record changes to the corresponding cloud secrets.
*** ### Google Cloud Secrets Sync GCP secrets sync makes use of whatever Google Role Policies have been granted to the Keeper Gateway in order to persist secrets. Below is the PAM Configuration data required for a successful sync:
FieldDescription
TitleConfiguration name, example: GCP Workspace Configuration
EnvironmentSelect: Google Cloud
GatewaySelect the Gateway that is configured on the Keeper Secrets Manager application.
Application FolderSelect the Shared folder where the PAM Configuration will be stored. We recommend placing this in a shared folder with the PAM User records.
GCP IDA unique ID for this instance of Google Cloud. This is only for your reference and can be anything, but its recommended to be kept short
Ex: GCP-DepartmentName
Service Account KeyCopy the JSON text of the service account key of the Gateway
LocationOne or more shared folders to link to the PAM Configuration. All the Keeper records in these shared folder/s will be synced.
Sync IdentityOptional role that if provided Keeper Gateway will use to sync records. The Sync Identity should have read/write access to Google Secrets Manager. If unspecified, the Gateway will use the credentials specified in the PAM Configuration.
Dry runCheck to allow users to preview the secrets before they are synced to the cloud. If unchecked, universal secrets sync will automatically sync Keeper record changes to the corresponding cloud secrets.
*** ### Universal Secrets Sync Workflow The basic workflow for running sync operations is the following: * (optional) Perform a one-time import of existing secrets from [AWS](#aws-secrets-sync) and/or [Azure](#azure-secrets-sync) and/or [GCP](#google-cloud-secrets-sync) via Commander * Set up a Keeper Gateway with associated permissions to manage secret resources * Set up a PAM cloud configuration with the Gateway and the required USS config settings * If "Dry run" is not selected, the sync jobs will execute automatically--workflow is done. * Otherwise, manually execute the sync via the [Commander CLI](/keeperpam/privileged-access-manager/universal-secrets-sync/discovery-using-commander.md) or the [Vault UI](/keeperpam/privileged-access-manager/universal-secrets-sync/discovery-using-the-vault.md). ### Next Steps: * [Universal Secrets Sync using Commander](https://app.gitbook.com/o/-LO5CAzoigGmCWBUbw9z/s/-MJXOXEifAmpyvNVL1to/~/edit/~/changes/2273/privileged-access-manager/discovery-1/discovery-using-commander) * [Universal Secrets Sync using the Vault](https://app.gitbook.com/o/-LO5CAzoigGmCWBUbw9z/s/-MJXOXEifAmpyvNVL1to/~/edit/~/changes/2273/privileged-access-manager/discovery-1/discovery-using-the-vault) --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.keeper.io/keeperpam/privileged-access-manager/universal-secrets-sync/discovery-basics.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.