> For the complete documentation index, see [llms.txt](https://docs.hivel.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hivel.ai/self-managed-hivel-deployment/virtual-private-cloud/azure/hivel-on-premises-deployment-guide-azure/security-and-secrets.md).

# Security and Secrets

* **Where credentials come from:** the AWS Access Key ID/Secret Access Key used for ECR are issued directly by Hivel to your named contact. The Azure Database for PostgreSQL admin credentials are created by you when you provision the server, and may optionally be stored in and retrieved from Azure Key Vault (see Database Setup and Database Migration for the retrieval command).

```
# Generate a strong random password:

openssl rand -base64 24
```

* **Least privilege:** this guide's two-phase credential pattern (admin credentials for the one-time migration, then the scoped application user \<user> for all running services - see [Database Setup](/self-managed-hivel-deployment/virtual-private-cloud/azure/hivel-on-premises-deployment-guide-azure/database-setup.md)) is the mechanism for least privilege here. Never run services with admin/root database credentials.
* **Secrets storage:** store all credentials (AWS keys, database passwords) in a secrets manager or Azure Key Vault, not in plaintext files or source control. config/.env is a plaintext file by design for this deployment model - treat the VM's filesystem access as sensitive.
* **Rotation:** rotate the application-user database password periodically - see the self-rotation steps below. This is a routine ALTER USER + .env change; it does not require touching the Flyway migration config or re-running migration (the Flyway config only matters once, for customizing the password before the initial migration - see Environment Configuration).

### Rotating the Application Database Password

You can self-rotate the application user's password at any time without re-running the Flyway migration:

1\. Connect to the database as the admin user and change the password:

{% code expandable="true" %}

```
ALTER USER <user> WITH PASSWORD 'new_password_here';
```

{% endcode %}

2\. Update DB\_PASSWORD in config/.env on the VM to match (see the password-quoting rules in Environment Configuration), then recreate the containers on the VM:

{% code expandable="true" %}

```
# config/.env
DB_PASSWORD='new_password_here'

./deploy.sh --vm   # on VM
```

{% endcode %}

**Notes:**

* Existing pooled connections keep working on the old password until they naturally reconnect, at which point they fail. Don't wait to find out - recreate the containers as above right after rotating the password.
* Escape $ in config/.env: Docker Compose interpolates ${...} and $VAR in this file, so a $ in the password must be written as $$. If the password contains # or spaces, wrap the value in single quotes (see Password Quoting in Environment Configuration).

### Rotating AWS ECR Pull Credentials

Hivel has not published a fixed cadence or self-service process for rotating the AWS Access Key ID/Secret Access Key issued for ECR access. Contact your Hivel representative for the current process if you need to rotate these credentials.

**Next step:** Quick Reference.

<br>

{% columns %}
{% column %} <a href="/self-managed-hivel-deployment/virtual-private-cloud/azure/hivel-on-premises-deployment-guide-azure/uninstall-and-cleanup.md" class="button primary" data-icon="backward">Uninstall and Cleanup</a>
{% endcolumn %}

{% column %}

{% endcolumn %}

{% column %} <a href="/self-managed-hivel-deployment/virtual-private-cloud/azure/hivel-on-premises-deployment-guide-azure/quick-reference.md" class="button primary" data-icon="forward">Quick Reference</a>
{% endcolumn %}
{% endcolumns %}