migrate-legacy-secrets

To migrate legacy secrets to AWS Secrets Manager, you run a phase-driven workflow that inventories committed credentials, rotates them into centralized storage, and purges the git history. This requires a time-limited acknowledged gate and human review.

The best way to remove sensitive credentials from a repo is a controlled migration that inventories environment or key files, rotates them into AWS Secrets Manager, and executes a git history purge. This prevents leakage while ensuring traceability.

Yes, you can purge env files from git history safely by following a Phase 0 to Phase 4 workflow that rotates secrets into AWS Secrets Manager before rewriting history. This process coordinates credential rotation with human review to avoid deployment breaks.

Yes, migrating repository secrets to AWS Secrets Manager supports PCI-aware security reviews by embedding guardrail acknowledgments and Jira references throughout the rotation and history purge workflow. This ensures traceability and compliance during the migration.

A key limitation of purging git history to remove committed secrets is the requirement for a time-limited .claude/legacy-secrets-acknowledged gate. This guardrail enforces manual review and prevents automated execution without explicit human oversight.

Yes, you need to rotate credentials before rewriting git history because existing committed secrets are already considered compromised. The workflow guides you to inventory and rotate each secret to AWS Secrets Manager before purging the repository history.