hi all – I have a question about best practices around using secrets. I'm migrating a script to Prefect that has depended on a sensitive value being stored as an environment variable. Initially I was thinking to just using a

Secret

to set this sensitive value as one of the run config's environment variables, e.g.

env = { 'SECRET_KEY' : Secret("SECRET_VALUE").get() }

, but I'm wondering if this raises some kind of security issue when registering the flow to my Cloud instance. In this setup, would this

Secret

value be retrieved at the time of registration and then sent to Prefect Cloud as a part of the flow's metadata? Or would Prefect know that this env variable should be brought into the run config container only at flow runtime, and it's perfectly safe to do something like this?

Hi @Sean Talia! What RunConfig would you be using in this case?

just the

DockerRun

config

I think this might fail because Secrets are evaluated at runtime while the RunConfig is evaluated at build time. But even if it does work, yes I think this would be a security issue and it will be sent to Prefect Cloud as part of metadata.

okay perfect, thanks for confirming @Kevin Kho !