Use of local secrets

[sti0]

Hi there,

I have a question about the use of local secrets placed in the config.toml file. Is it right, that if I register the flow to another instance the local secrets form my config.toml are attached to the flow? And if I execute the flow it runs with the secret values of my config.toml instead of the values of the other instance? And even if I use it fully local, the flow needs to re-registered after changing the secrets?

I ask because the docs are not clear to me in that point:

Very often, workflows require sensitive information to run: API keys, passwords, tokens, credentials, etc. As a matter of best practice, such information should never be hardcoded into a workflow's source code, as the code itself will need to be guarded.

Secret tasks, which are special tasks that can be used in your flow when working with sensitive information. Unlike regular tasks, Secret tasks are designed to access sensitive information at runtime and use a special SecretResult to ensure the results are not stored.

Thanks + BR

[zanieb]

Hi @sti0

Is it right, that if I register the flow to another instance the local secrets form my config.toml are attached to the flow?

This is not the case. That instance will need the secrets stored in its local config. If you are using Prefect Cloud, you can store them in a secure vault and add secrets via the UI/API--then they will be available everywhere.

And even if I use it fully local, the flow needs to re-registered after changing the secrets?

This is also not the case. The secrets are pulled by the flow at runtime.

[sti0]

@madkinsz thank you for your answer. It was my fault. I used the Secret as described here. If I use the PrefectSecret it works as expected.