Migrating secrets from a cloud environment to a local system

1 . A system comprising:

a processing device; and

a memory device including instructions that are executable by the processing device for causing the processing device to perform operations comprising:

receiving a secret stored in a cloud environment from a secret manager associated with the cloud environment, the cloud environment configured to store the secret in a storage resource to which a geographic location is assigned;

identifying a source location associated with the secret , the source location of the secret corresponding to the geographic location of the storage resource in the cloud environment;

determining, using a lookup table and the source location, a location identifier corresponding to the source location, the location identifier representing a geographic region comprising the source location of the secret;

determining whether a filesystem corresponding to the location identifier of the secret is present in a physical server of an on-premises computing environment, the physical server comprising a plurality of filesystems, wherein each filesystem of the plurality of filesystems is associated with a respective location identifier representing a respective geographic region; and

in response to determining that the filesystem in the physical server of the on-premises computing environment corresponds to the location identifier of the secret, storing the secret in the filesystem of the physical server, the secret comprising a privileged credential used to control access to one or more protected computing resources.

2 . The system of claim 1 , wherein the operations further comprise, subsequent to identifying the source location of the secret:

in response to determining that the physical server lacks the filesystem corresponding to the location identifier of the secret, generating the filesystem in the physical server such that the filesystem is mapped to the location identifier of the secret.

3 . The system of claim 1 , wherein the secret is a first secret stored in a first cloud environment managed by a first secret manager, and wherein the operations further comprise:

receiving a second secret from a second secret manager different from the first secret manager, wherein the second secret is stored in a second cloud environment separate from the first cloud environment;

determining that the second secret is a duplicate of the first secret by comparing a first hash of the first secret to a second hash of the second secret;

identifying a second source location associated with the second secret, the second source location being mappable to the location identifier corresponding to the filesystem; and

storing the second secret with an incremented version number in the filesystem of the physical server subsequent to determining that the second secret is the duplicate of the first secret.

4 . The system of claim 1 , wherein the operations further comprise, subsequent to storing the secret in the filesystem:

identifying a software application configured to use the secret to access the one or more protected computing resources; and

modifying a configuration of the software application to use the secret stored in the filesystem of the physical server, wherein the secret is configured to be removed from the cloud environment subsequent to storing the secret in the filesystem.

5 . The system of claim 1 , wherein the operations further comprise:

identifying an encryption key used to encrypt the secret stored in the cloud environment; and

prior to storing the secret in the filesystem of the physical server, encrypting the secret using the encryption key.

6 . The system of claim 1 , wherein the operations further comprise, subsequent to identifying the source location of the secret:

identifying a rule set associated with the source location, wherein the rule set defines a cryptographic requirement corresponding to the source location.

7 . The system of claim 6 , wherein the operations further comprise:

using the rule set to determine an encryption key to encrypt the secret prior to storing the secret in the filesystem; and

encrypting the secret using the encryption key to fulfill the cryptographic requirement defined by the rule set.

8 . A method comprising:

receiving a secret stored in a cloud environment from a secret manager associated with the cloud environment, the cloud environment storing the secret in a storage resource to which a geographic location is assigned;

identifying a source location associated with the secret , the source location of the secret corresponding to the geographic location of the storage resource in the cloud environment;

determining, using a lookup table and the source location, a location identifier corresponding to the source location, the location identifier representing a geographic region comprising the source location of the secret;

determining whether a filesystem corresponding to the location identifier of the secret is present in a physical server of an on-premises computing environment, the physical server comprising a plurality of filesystems, wherein each filesystem of the plurality of filesystems is associated with a respective location identifier representing a respective geographic region; and

in response to determining that the filesystem in the physical server of the on-premises computing environment corresponds to the location identifier of the secret, storing the secret in the filesystem of the physical server, the secret comprising a privileged credential used to control access to one or more protected computing resources.

9 . The method of claim 8 , further comprising, subsequent to identifying the source location of the secret:

in response to determining that the physical server lacks the filesystem corresponding to the location identifier of the secret, generating the filesystem in the physical server such that the filesystem is mapped to the location identifier of the secret.

10 . The method of claim 8 , wherein the secret is a first secret stored in a first cloud environment managed by a first secret manager, and wherein the method further comprises:

receiving a second secret from a second secret manager different from the first secret manager, wherein the second secret is stored in a second cloud environment separate from the first cloud environment;

determining that the second secret is a duplicate of the first secret by comparing a first hash of the first secret to a second hash of the second secret;

identifying a second source location associated with the second secret, the second source location being mappable to the location identifier corresponding to the filesystem; and

storing the second secret with an incremented version number in the filesystem of the physical server subsequent to determining that the second secret is the duplicate of the first secret.

11 . The method of claim 8 , further comprising, subsequent to storing the secret in the filesystem:

identifying a software application configured to use the secret to access the one or more protected computing resources; and

modifying a configuration of the software application to use the secret stored in the filesystem of the physical server, wherein the secret is removed from the cloud environment subsequent to storing the secret in the filesystem.

12 . The method of claim 8 , further comprising:

identifying an encryption key used to encrypt the secret stored in the cloud environment; and

prior to storing the secret in the filesystem of the physical server, encrypting the secret using the encryption key.

13 . The method of claim 8 , further comprising, subsequent to identifying the source location of the secret:

identifying a rule set associated with the source location, wherein the rule set defines a cryptographic requirement corresponding to the source location.

14 . The method of claim 13 , further comprising:

using the rule set to determine an encryption key to encrypt the secret prior to storing the secret in the filesystem; and

encrypting the secret using the encryption key to fulfill the cryptographic requirement defined by the rule set.

15 . A non-transitory computer-readable medium comprising program code executable by a processing device for causing the processing device to perform operations comprising:

receiving a secret stored in a cloud environment from a secret manager associated with the cloud environment, the cloud environment configured to store the secret in a storage resource to which a geographic location is assigned;

identifying a source location associated with the secret , the source location of the secret corresponding to the geographic location of the storage resource in the cloud environment;

determining, using a lookup table and the source location, a location identifier corresponding to the source location, the location identifier representing a geographic region comprising the source location of the secret;

determining whether a filesystem corresponding to the location identifier of the secret is present in a physical server of an on-premises computing environment, the physical server comprising a plurality of filesystems, wherein each filesystem of the plurality of filesystems is associated with a respective location identifier representing a respective geographic region; and

in response to determining that the filesystem in the physical server of the on-premises computing environment corresponds to the location identifier of the secret, storing the secret in the filesystem of the physical server, the secret comprising a privileged credential used to control access to one or more protected computing resources.

16 . The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise, subsequent to identifying the source location of the secret:

in response to determining that the physical server lacks the filesystem corresponding to the location identifier of the secret, generating the filesystem in the physical server such that the filesystem is mapped to the location identifier of the secret.

17 . The non-transitory computer-readable medium of claim 15 , wherein the secret is a first secret stored in a first cloud environment managed by a first secret manager, and wherein the operations further comprise:

receiving a second secret from a second secret manager different from the first secret manager, wherein the second secret is stored in a second cloud environment separate from the first cloud environment;

determining that the second secret is a duplicate of the first secret by comparing a first hash of the first secret to a second hash of the second secret;

identifying a second source location associated with the second secret, the second source location being mappable to the location identifier corresponding to the filesystem; and

storing the second secret with an incremented version number in the filesystem of the physical server subsequent to determining that the second secret is the duplicate of the first secret.

18 . The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise, subsequent to storing the secret in the filesystem:

identifying a software application configured to use the secret to access the one or more protected computing resources; and

modifying a configuration of the software application to use the secret stored in the filesystem of the physical server, wherein the secret is configured to be removed from the cloud environment subsequent to storing the secret in the filesystem.

19 . The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:

identifying an encryption key used to encrypt the secret stored in the cloud environment; and

prior to storing the secret in the filesystem of the physical server, encrypting the secret using the encryption key.

20 . The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise, subsequent to identifying the source location of the secret:

identifying a rule set associated with the source location, wherein the rule set defines a cryptographic requirement corresponding to the source location.