1

We have Apex code with callouts that use hardcoded credentials. Our organization wants to replace the hardcoded credentials with a secure key store that we can retrieve the credentials from. We are familiar with AWS Secrets Manager / AWS Key Management Service and would like to use something similar from within Salesforce.

Is there anything similar to AWS Secrets Manager within Salesforce? It doesn't seem like it.

We've looked at Named Credentials, but they don't handle all our use cases. Protected Custom Settings or Protected Custom Metadata seem like a possible solution, but we really don't want to take on the overhead of using managed packages.

What's the best solution for a development team that is used to working with AWS Secrets Manager and similar type key storage services?

Improve this question
2
  • 3
    There isn't a direct equivalent. It appears you've read Storing Sensitive Data and are familiar with the available options. Named Credentials is the best option since it doesn't expose credentials in local (your tenant/org) memory.
    – identigral
    Jan 11 at 21:58
  • 3
    While there is definitely a learning curve, 2GP managed packages are fairly easy to set up and work with, so protected custom metadata plus appropriate packaged apex code that handles all the callouts using the details from these CMT records (meaning the details are never visible outside that package) would be my recommendation if named credentials don't work for you.
    – Phil W
    Jan 11 at 22:01

1 Answer 1

Reset to default
0

To reduce the effort of having to create managed packages for "one-off" secrets, we created a general purpose ENV management library.

It's closer to Heroku ENV management than AWS secrets manager, in that it can be used for global key-value settings of any kind (with support for secrets).

It works by storing an encryption key in a Managed Package, which is then used to encrypt and decrypt secrets stored in the ENV Custom Metadata.

The tradeoff is that it's less secure than a dedicated Managed Package (with the secret completely encapsulated), as anyone with the ability to execute anon apex can decrypt the secrets.

As stated in the comments, Named Credentials are always the best solution when possible.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .