External Secret Managers Private Preview

You must be on the Business Critical plan and have the Account Administrator role to manage External Secret Managers. To get access to this feature, contact your Fivetran account team.

Many organizations, particularly in regulated industries such as finance, healthcare, and government, are required to maintain direct control over their cryptographic keys and secrets. This is often mandated by compliance policies, but is also increasingly an enterprise security preference — especially for teams that need to enforce their own rotation schedules, audit trails, and data residency requirements.

The External Secret Managers (ESM) feature lets you store and manage your connection and destination credentials in your own external secret management service rather than in Fivetran. When ESM is enabled for a connection or destination, Fivetran reads the required credentials directly from your external service at sync time. This gives you:

Direct control over secret rotation, expiry, and deletion
Data residency compliance for credential encryption keys and secrets
Simpler internal security audits — your team audits your own systems, not ours
A more complete Hybrid Deployment security posture, where credentials no longer need to transit the Fivetran control plane

The External Secret Managers feature supports the following deployment models:

The deployment model of an External Secret Manager must match the deployment model of the connection or destination that uses it.

Fivetran supports the following External Secret Management services:

Supported connectors and destinations

Destinations

Connectors

How external secret managers work

You add your connection and destination credentials to your chosen secret management service, which stores and manages them, including rotation.
You configure your chosen secret management service to allow Fivetran to access it. See the setup guide for your provider:
You create an External Secret Manager in Fivetran and link it to your secret management service.
When setting up a new connection or destination (provided it supports this feature), you select the External Secret Manager you created, and Fivetran reads the required credentials from the external service.

Enable ESM during connection or destination setup

When you set up a connection or destination that supports ESM, the setup form includes a Use External Secrets Manager toggle.

For some connectors and destinations, the toggle only appears after you select a credential-based authentication method.

To use an external secret manager for a connection or destination:

In the connection or destination setup form, enable the Use External Secrets Manager toggle.
Select an existing External Secret Manager from the drop-down menu.
The list is filtered by the deployment model of the connection or destination. External Secret Managers configured for Hybrid Deployment are not available for connections and destinations using SaaS Deployment, and vice versa.
- To edit the details of the selected External Secret Manager, click Edit manager details in Account Settings.
- To set up a new External Secret Manager instead, click Configure a new secrets manager. See Create New External Secret Manager for prerequisites and setup instructions.
- You can manage all your External Secret Managers at any time under Account Settings. See the External Secret Managers documentation for more information.
When ESM is enabled, credential fields in the setup form are replaced by ESM key fields. In each ESM key field, enter the identifier that points to the secret in your external service - not the credential value itself. What you enter depends on your secret management service:
- HashiCorp Vault - Enter the key name within the vault path configured for this External Secret Manager. The vault path is set at the manager level and can hold secrets for multiple connections simultaneously. Each ESM key field value is the name of a specific key within that shared path.
- AWS Secrets Manager - Enter the secret ARN or name. Each ESM key field maps to one discrete secret in AWS Secrets Manager. The secret's value can be a plaintext string or a JSON object. AWS automatically creates JSON-format secrets for RDS databases, storing credentials as username and password fields within the same secret - Fivetran reads the appropriate field from the JSON automatically.
- Google Secret Manager - Enter the secret name. Each ESM key field maps to one discrete secret in Google Secret Manager, whose value is a single plaintext string.
- Azure Key Vault - Enter the secret name. Each ESM key field maps to one discrete secret in Azure Key Vault, whose value is a single plaintext string.