Documentation for integrating AWS Secrets Manager with IIQ build/deployment

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Our IIQ project currently stores encrypted passwords (1:ACP, 2:ACP and etc,) in Git. Client requires plaintext passwords to live only in AWS Secrets Manager, with Git holding just a secret reference (value).

Please share any documentation or guide for integrating AWS Secrets Manager with IIQ, including how to apply it in our build/deployment process (e.g., SSB) so no secrets are stored in Git.

Environment: IIQ version/patch: 8.4p2

2

@sunilasm What you can do is:

  1. Store secret in AWS Secret Manager
  2. Store the secret path in the target.properties.
  3. In your build script, you need to make API call to AWS Secret Manager to get the secrets and replace the target.properties secret paths with exact password.
  4. So, during build, first it will fetch creds, update target.properties and then generate the updated war file with actual creds.
3

Hello Sunil. Neel’s CI/CD approach looks reasonable. I would suggest a few additional checks for IIQ 8.4p2:

  1. AWS access: Use an IAM role instead of static keys, with secretsmanager:GetSecretValue and kms:Decrypt if the secret uses a customer-managed KMS key.
  2. SSB integration: Keep only secret references in Git. Retrieve the credentials during the build and prevent exposure in logs or generated files.
  3. Encryption: Plaintext substitution may expose passwords in the WAR. Consider substituting IIQ-encrypted values instead, where the field supports it, and verify compatibility with the target keystore. Note that iiq encrypt defaults to key 1 and takes the plaintext as a command argument, so be careful with key selection and process exposure in CI.

SSB substitution happens at build time, not runtime. Secret rotation would require updating the affected IIQ configuration.