Security-gated credential access for Go applications. Combines Posture (security posture assessment) with OmniVault (secret management) to provide environment-aware secure credential handling.
- 🔍 Automatic Environment Detection - Detects local workstations, AWS EKS, GCP GKE, Azure AKS, Lambda, Cloud Run, and more
- 🛡️ Security Policy Enforcement - Define security requirements that must be met before credentials are accessed
- ⚡ Provider Auto-Selection - Automatically uses the right secret provider for each environment
- 🌐 Cross-Platform - Works on macOS, Windows, Linux, and all major cloud platforms
package main
import (
"context""log""github.com/plexusone/vaultguard"
)
funcmain() {
ctx:=context.Background()
// Create a secure vault with default settingssv, err:=vaultguard.Quick()
iferr!=nil {
log.Fatalf("Security check failed: %v", err)
}
defersv.Close()
// Get credentialsapiKey, err:=sv.GetValue(ctx, "API_KEY")
iferr!=nil {
log.Fatal(err)
}
log.Printf("Environment: %s, Provider: %s", sv.Environment(), sv.Provider())
}| Environment | Detection | Security Checks | Default Provider |
|---|---|---|---|
| Local (macOS/Windows/Linux) | Automatic | Posture (TPM, encryption, Secure Boot) | Keyring |
| AWS EKS | IRSA env vars | IRSA validation, role ARN checks | AWS Secrets Manager |
| AWS Lambda | Lambda env vars | IAM validation | AWS Secrets Manager |
| GCP GKE | Workload Identity | Service account validation | GCP Secret Manager |
| GCP Cloud Run | K_SERVICE env | IAM validation | GCP Secret Manager |
| Azure AKS | Workload Identity | Client/tenant validation | Azure Key Vault |
| Kubernetes | Service account mount | Namespace, SA validation | K8s Secrets |
| Container | Docker/cgroup detection | Basic checks | Environment vars |
sv, _:=vaultguard.Quick() // Uses DefaultPolicy()sv, _:=vaultguard.QuickDev() // Relaxed for developmentsv, _:=vaultguard.QuickStrict() // High security requirementssv, err:=vaultguard.New(&vaultguard.Config{
Policy: &vaultguard.Policy{
Local: &vaultguard.LocalPolicy{
MinSecurityScore: 75,
RequireEncryption: true,
RequireTPM: true,
},
Cloud: &vaultguard.CloudPolicy{
RequireIAM: true,
AWS: &vaultguard.AWSPolicy{
RequireIRSA: true,
AllowedRoleARNs: []string{
"arn:aws:iam::123456789:role/my-app-*",
},
},
},
Kubernetes: &vaultguard.KubernetesPolicy{
DeniedNamespaces: []string{"default", "kube-system"},
},
},
})Policies can be loaded from JSON configuration files, supporting both user preferences and enterprise-wide enforcement.
Policies are loaded in order of precedence (highest first):
AGENTPLEXUS_POLICY_FILEenvironment variable- User config:
~/.plexusone/policy.json - System config:
/etc/plexusone/policy.json(Linux/macOS) or%ProgramData%\plexusone\policy.json(Windows)
// Load policy from configuration filespolicy, err:=vaultguard.LoadPolicy()
iferr!=nil {
log.Fatal(err)
}
sv, err:=vaultguard.New(&vaultguard.Config{
Policy: policy,
})~/.plexusone/policy.json:
{
"version": 1,
"local": {
"min_security_score": 60,
"require_encryption": true
},
"provider_map": {
"local": "keyring"
}
}System administrators can deploy organization-wide policies with locked fields that users cannot override.
/etc/plexusone/policy.json:
{
"version": 1,
"local": {
"min_security_score": 50,
"require_encryption": true
},
"cloud": {
"require_iam": true,
"aws": {
"require_irsa": true,
"allowed_account_ids": ["123456789012"]
}
},
"allow_insecure": false,
"locked": [
"local.require_encryption",
"cloud.require_iam",
"allow_insecure"
]
}When both system and user configs exist, they are merged with system settings taking precedence on locked fields.
// Pre-flight security checkresult, err:=vaultguard.CheckSecurity(nil)
fmt.Printf("Security score: %d\n", result.Score)
// Require security (for init functions)iferr:=vaultguard.RequireSecurity(nil); err!=nil {
log.Fatal(err)
}
// Quick credential accessapiKey, err:=vaultguard.GetEnv(ctx, "API_KEY", nil)
// Load multiple credentialscreds, err:=vaultguard.LoadCredentials(ctx, nil,
"GOOGLE_API_KEY",
"ANTHROPIC_API_KEY",
"OPENAI_API_KEY",
)
// Load required credentials (error if any missing)creds, err:=vaultguard.LoadRequiredCredentials(ctx, nil,
"GOOGLE_API_KEY",
"SERPER_API_KEY",
)┌─────────────────────────────────────────────────────────────────────┐
│ VaultGuard │
│ │
│ 1. Environment Detection │
│ DetectEnvironment() → local | eks | gke | aks | lambda | ... │
│ │
│ 2. Security Checks (based on environment) │
│ ┌─────────────────────┐ ┌────────────────────────────────┐ │
│ │ Local (Posture) │ │ Cloud │ │
│ │ • Secure Enclave │ │ • IRSA/Workload Identity │ │
│ │ • Disk Encryption │ │ • Role/Account validation │ │
│ │ • Secure Boot │ │ • Namespace restrictions │ │
│ └─────────────────────┘ └────────────────────────────────┘ │
│ │
│ 3. Provider Auto-Selection │
│ local → keyring | eks → aws-sm | gke → gcp-sm | ... │
│ │
│ 4. Credential Access (via OmniVault) │
│ sv.GetValue(ctx, "API_KEY") → secret value │
└─────────────────────────────────────────────────────────────────────┘
package main
import (
"context""log""github.com/plexusone/vaultguard"
)
funcmain() {
ctx:=context.Background()
// Security-gated credential loadingsv, err:=vaultguard.New(&vaultguard.Config{
Policy: &vaultguard.Policy{
Local: &vaultguard.LocalPolicy{
MinSecurityScore: 50,
RequireEncryption: true,
},
Cloud: &vaultguard.CloudPolicy{
RequireIAM: true,
},
},
})
iferr!=nil {
log.Fatalf("Security requirements not met: %v", err)
}
defersv.Close()
// Load agent credentialscreds, err:=sv.LoadRequiredCredentials(ctx, nil,
"LLM_PROVIDER",
"GOOGLE_API_KEY",
"SERPER_API_KEY",
)
iferr!=nil {
log.Fatal(err)
}
// Start agents with credentials...log.Printf("Starting agents with provider: %s", creds["LLM_PROVIDER"])
}go get github.com/plexusone/vaultguardFull documentation is available at plexusone.github.io/vaultguard including:
MIT License