setBackendType(v)}> {#snippet children({ item: toggleButton })} {/snippet} {#if vaultDisabled}
External secret store integrations require Enterprise Edition
{/if}
{#if selectedType === 'Database'}

Database Storage (Default)

Secrets are encrypted using workspace-specific keys and stored in the PostgreSQL database.

{:else if selectedType === 'HashiCorpVault'}

HashiCorp Vault Configuration Beta

Store secrets in an external HashiCorp Vault instance.

The KV v2 secrets engine mount path in Vault
Authentication Method setAuthMethod(v)}> {#snippet children({ item: toggleButton })} {/snippet}
{#if authMethod === 'token'}
Static token. Recommended only for testing/development.
{:else}
The JWT authentication role configured in Vault.
Vault JWT Setup Instructions

Configure Vault to accept JWTs from Windmill:

# Enable JWT auth method
vault auth enable jwt

# Configure JWT auth with Windmill's JWKS endpoint
vault write auth/jwt/config \
  jwks_url="{baseUrl}/.well-known/jwks.json" \
  bound_issuer="{baseUrl}"

# Create a policy for Windmill secrets
vault policy write windmill-secrets - <<EOF
path "windmill/data/*" {
  capabilities = ["create", "read", "update", "delete"]
}
path "windmill/metadata/*" {
  capabilities = ["list", "delete"]
}
EOF

# Create the JWT role
vault write auth/jwt/role/windmill-secrets \
  role_type="jwt" \
  bound_audiences="{baseUrl}" \
  user_claim="email" \
  policies="windmill-secrets" \
  ttl="1h"
{/if}
Vault Enterprise namespace
Disables TLS verification when connecting to Vault. Only enable for self-signed certificates in development.
Secret Migration Original values are NOT deleted to allow for rollback.

Database → Vault

Vault → Database

{:else if selectedType === 'AzureKeyVault'}

Azure Key Vault Configuration

Store secrets in an Azure Key Vault instance.

Static Bearer token for testing. If provided, OAuth2 is skipped.
Secret Migration Original values are NOT deleted to allow for rollback.

Database → Azure Key Vault

Azure Key Vault → Database

{:else if selectedType === 'AwsSecretsManager'}

AWS Secrets Manager Configuration Beta

Store secrets in AWS Secrets Manager.

If not provided, the default AWS credential chain is used (env vars, instance profile, EKS pod identity)
Prefix for secret names in AWS Secrets Manager (default: windmill/)
Custom endpoint for LocalStack or other compatible services
Secret Migration Original values are NOT deleted to allow for rollback.

Database → AWS Secrets Manager

AWS Secrets Manager → Database

{/if}
{ migrateToAwsSmModalOpen = false }} onConfirmed={migrateSecretsToAwsSm}> {#snippet children()}

This will copy all secrets from the database to AWS Secrets Manager.

Database values are NOT deleted automatically.

{/snippet} { migrateFromAwsSmModalOpen = false }} onConfirmed={migrateSecretsFromAwsSm}> {#snippet children()}

This will copy all secrets from AWS Secrets Manager back to the database.

AWS Secrets Manager values are NOT deleted automatically.

{/snippet} { migrateToAzureKvModalOpen = false }} onConfirmed={migrateSecretsToAzureKv}> {#snippet children()}

This will copy all secrets to Azure Key Vault.

Database values are NOT deleted automatically.

{/snippet} { migrateFromAzureKvModalOpen = false }} onConfirmed={migrateSecretsFromAzureKv}> {#snippet children()}

This will copy all secrets from Azure Key Vault back to the database.

{/snippet} { migrateToVaultModalOpen = false }} onConfirmed={migrateSecretsToVault}> {#snippet children()}

This will copy all secrets to HashiCorp Vault.

Database values are NOT deleted automatically.

{/snippet} { migrateToDatabaseModalOpen = false }} onConfirmed={migrateSecretsToDatabase}> {#snippet children()}

This will copy all secrets from Vault back to the database.

{/snippet}