Secret access

Use secretctl as the only secret frontend. It uses one BWS credential internally.

Vault names, project IDs, and permissions are dynamic. Inspect the active config instead of assuming a vault or policy:

secretctl config show
secretctl auth status bws
secretctl status

The config and status contain metadata only.

Security boundary