Migration

Import secrets from AWS, Azure, or GCP into Keeper for the initial setup of Universal Secrets Sync

Overview

This guide covers how to migrate existing secrets from a cloud provider (AWS, Azure, or Google Cloud) into Keeper, then replicate them back to the cloud via Universal Secrets Sync ("USS"). After completing this guide, Keeper becomes the source of truth and USS maintains the cloud provider copy automatically going forward.

Before you begin

Complete the setup steps in Universal Secrets Sync Basics before proceeding. You will need an active KeeperPAM license, a running Keeper Gateway, and a PAM Configuration for your target cloud environment.

Migration Steps

Step 1 - Create a shared folder

Create a shared folder in the Vault. This folder will hold the secrets imported from the cloud provider and will be the sync source going forward.

Step 2 - Import existing secrets into Keeper

Perform a one-time import of existing secrets from your cloud provider into the shared folder via Keeper Commander:

• Import from AWS Secrets Manager
• Import from Azure Key Vault
• Import from Google Secret Manager

Step 3 - Review imported secrets

Review the imported records in the Keeper Vault and verify that all expected fields and values are present before proceeding.

Step 4 - Configure the Gateway

Set up a Keeper Gateway with the permissions required to read and write to the target cloud secrets manager. The Gateway itself, or the associated Sync Identity role, must have read/write access to the cloud secrets manager service.

Step 5 - Link the folder to the KSM application

In the Vault, open the KSM Application associated with your Gateway and add the shared folder under Folders & Records. This grants the application access to the records that will be synced.

Step 6 - Configure USS on the PAM Configuration

Open the PAM Configuration for your target cloud environment and configure USS:

1. Scroll to the Universal Secrets Sync section and enable it
2. Under Locations, select the shared folder created in Step 1
3. Leave Dry-run unchecked so that sync jobs execute automatically
4. Save the configuration

Step 7 - Start the Gateway

If the Keeper Gateway is not already running, start it now.

Step 8 - Verify the sync

Sync jobs will begin executing automatically. Migrated secrets will be tagged in the cloud provider to indicate they are now managed by Keeper:

Cloud provider	Tag / label
AWS	Key: Source / Value: KeeperSecretsManager
Azure	tags: {"Source": "KeeperSecretsManager"}
GCP	labels: {"source": "keeper_secrets_manager"}

Migration is complete. Keeper is now the source of truth. Any subsequent changes to records in the shared folder will be pushed to the cloud provider automatically via USS.

Related Pages

• USS Overview - Feature summary, architecture, and key capabilities
• USS Basics - Prerequisites and PAM Configuration setup
• Using Commander - CLI reference and dry-run workflow
• Using the Vault - Step-by-step Vault UI walkthrough