Hello, I'm currently reevaluating prefect. You can securely store secrets locally for local execution. Is that that correct? If it is, is there a process for backup/restore of a large amount of secrets? or some kind of import/export interface? Otherwise migrating to a new computer or passing secrets to a new team mate would quickly become a hassle if you have hundreds of secrets to manage.

hi @Niklaus > some kind of import/export interface you can think of prefect blocks like this, e.g. the

Secret

block

In [1]: from prefect.blocks.system import Secret

In [2]: Secret(value=dict(marvins_3rd_party_api_key='sk-asdfasdf'))
Out[2]: Secret(value=Secret('**********'))

In [3]: _.save("some-block-name")
Out[3]: UUID('9527e230-b043-461c-84df-3432f2f39309')

In [4]: Secret.load("some-block-name").get()["marvins_3rd_party_api_key"]
Out[4]: 'sk-asdfasdf'

calling

.save

on the block saves it to the database. the

value

can be any valid JSON (including strings) and so you can choose how to namespace your secrets

Hi @Nate, thanks for your answer. So you could probably write a script to export/import secrets if you have a list of their block names. Do I understand correctly, that there is no native functionality to backup/restore all local secrets? E.g. using a CLI command? (I could understand this design choice as it could also be security risk, but it makes migrating to a new computer a hassle)

> So you could probably write a script to export/import secrets if you have a list of their block names yep! > that there is no native functionality to backup/restore all local secrets secrets are just a type of block, and all blocks are stored in the db. there is no special handling to migrate secret blocks between databases, so a script would likely be the easiest way to do it!

Ah ok so the AI generated answer in the docs was wrong... how do you handle secrets for local dev environments then if you don't want to use the production secrets stored in server or cloud?

i wouldn’t say there’s one recommended way to manage dev secrets with prefect, because it depends on your use case and what’s ergonomic for that use case. Secret blocks are often used to store things like 3rd party api tokens. with cloud, people will often have a workspace for dev or stg where they save some secrets there and then a separate prod workspace with their prod deployments and the secrets used for them. a workspace is essentially like one server so if you’d be using open source it’d be same deal with separate servers instead of workspaces. i’ll also mention that oftentimes people never save secrets and instead opt to have their client execution environment (eg ECS service running a prefect worker with an attached execution ARN) load secrets at runtime from a third party store like Vault for Secrets Manager