> For the complete documentation index, see [llms.txt](https://docs.hivel.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hivel.ai/self-managed-hivel-deployment/virtual-private-cloud/aws/hivel-on-premises-deployment-guide-aws/security-and-secrets.md).

# Security and Secrets

## Credential Types and Sources

Your deployment uses three types of credentials:

### **ECR Access Credentials**

* **Source:** Issued by Hivel to your named contact (unless using Option B, in which case you generate and control your own)
* **Scope:** Hivel's ECR repository only (or your own if Option B)
* **Usage:** Pulling container images during deployment

### **RDS Master Credentials**

* **Source:** Created when you provision the RDS instance (RDS Database Setup)
* **Storage option:** If using AWS Secrets Manager, credentials live there instead of plaintext
* **Usage:** One-time database migration only (Database Migration)

### **Application User Credentials**

* **Source:** Created automatically by flyway-migration (Database Migration)
* **Default password:** Provided separately by Hivel
* **Usage:** All services connect to the database using these credentials

## Storing Credentials

Store all credentials in a secrets manager:

* AWS Secrets Manager
* Your organization's standard secrets tool

**Do not:**

* Store credentials in plaintext files
* Commit .env or other credential files to version control

**Note on config/.env:** This is a plaintext file by design for this deployment. Treat VM filesystem access as sensitive.

### Least Privilege: Two-Phase Credential Pattern

This deployment implements least privilege for database access:

1. **Phase 1 (migration only):** Root/master credentials used one time during database setup
2. **Phase 2 (services):** All running services use scoped application-user credentials

See [RDS Database Setup](/self-managed-hivel-deployment/virtual-private-cloud/aws/hivel-on-premises-deployment-guide-aws/rds-database-setup.md) and [Environment Configuration](/self-managed-hivel-deployment/virtual-private-cloud/aws/hivel-on-premises-deployment-guide-aws/project-setup-and-environment-configuration.md) for details.

## Rotating Credentials

**Application User Password (Self-Rotatable)**

You can rotate the application-user database password at any time without re-running migrations.

### **Step 1: Generate a strong password**

#### **Step 2: Update RDS**

On the RDS instance, run:

```
ALTER USER <user> WITH PASSWORD 'new_password_here';
```

### **Step 3: Update config/.env on the VM**

Edit `config/.env` and replace the old password:

```
DB_PASSWORD=new_password_here
```

Refer to Environment Configuration for password-quoting rules.

### **Step 4: Restart services on the VM**

```
./deploy.sh --restart
```

{% hint style="warning" %}
**Important:** Existing database connections survive the password change but fail when they reconnect. Restart services immediately to avoid connection pool issues.
{% endhint %}

**RDS Master Credentials**

Do not rotate the RDS master credentials. They are used only during initial setup.

**ECR Access Credentials**

Hivel does not currently publish a rotation cadence. To rotate ECR credentials, contact your Hivel representative.

{% columns %}
{% column %} <a href="/self-managed-hivel-deployment/virtual-private-cloud/aws/hivel-on-premises-deployment-guide-aws/uninstall-and-cleanup.md" class="button primary" data-icon="backward">Back to Uninstall and Cleanup</a>
{% endcolumn %}

{% column %}

{% endcolumn %}

{% column %} <a href="/self-managed-hivel-deployment/virtual-private-cloud/aws/hivel-on-premises-deployment-guide-aws/quick-reference.md" class="button primary" data-icon="forward">Quick Reference</a>
{% endcolumn %}
{% endcolumns %}