[Yandex Cloud documentation](../../index.md) > [Yandex Lockbox](../index.md) > [Step-by-step guides](index.md) > Creating secrets

# Creating secrets


To create a [secret](../concepts/secret.md):

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create your secret.
  1. Navigate to **Lockbox**.
  1. Click **Create secret**.
  1. In the **Name** field, enter a name for the secret.
  1. Optionally, to break down resources into logical groups, add a [label](../../resource-manager/concepts/labels.md).
  1. Optionally, enable **Block secret deletion**. You cannot delete a secret with this option enabled. This does not protect the contents of the secret against modification.
  1. Select **Secret type**:
      * **Generated**: To generate the value automatically:
  
        * In the **Key** field, enter a non-secret ID.
        * (Optional) Expand the **Automatic generation options** section and set the confidential value parameters (e.g., password).
  
      * **Custom**: To set the value manually:

        * In the **Key** field, enter a non-secret ID.
        * In the **Value** field, enter the confidential data you want to store.

          To add more data, click **Add key/value** and repeat the steps.
  1. (Optional) Under **KMS key**, specify an existing [key](../../kms/concepts/key.md) or [create a new one](../../kms/operations/key.md#create).

     The specified [Yandex Key Management Service](../../kms/index.md) key is used to encrypt your secret. If you do not specify a key, the secret will be encrypted with a special system key.

     {% note tip %}

     By using your own Key Management Service key, you can take full advantage of the benefits Key Management Service has to offer.

     {% endnote %}

  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View the description of the CLI command for creating a secret:

     ```bash
     yc lockbox secret create --help
     ```

  1. Run this command:

     ```bash
     yc lockbox secret create \
       --name <secret_name> \
       --description <secret_description> \
       --payload "<array_with_secret_contents>" \
       --cloud-id <cloud_ID> \
       --folder-id <folder_ID> \
       --deletion-protection
     ```

     Where:
     * `--name`: Secret name. This is a required setting.
     * `--description`: Secret description. This is an optional setting.
     * `--payload`: Secret content in YAML or JSON format.

       You can provide one or more `key` [keys](../../kms/concepts/key.md) at a time. If the secret is going to contain several values, list them separated by commas. If the keys are going to contain binary values, provide these in `base64` encoding.

       >For instance, to save the `username` key with the `myusername` text value and the `avatar` key with a binary value loaded from the `avatar.jpg` file, you can specify:
       >
       >`[{'key': 'username', 'text_value': 'myusername'},{'key': 'avatar', 'binary_value': $(base64 -w 0 ./avatar.jpg)}]`
     * `--cloud-id`: [ID of the cloud](../../resource-manager/operations/cloud/get-id.md) where you want to create your secret.
     * `--folder-id`: [ID of the folder](../../resource-manager/operations/folder/get-id.md) where you want to create your secret.
     * `--deletion-protection`: Secret deletion protection. You cannot delete a secret with this option enabled. This does not protect the secret's contents. This is an optional setting.

     >Sample command for creating a secret:
     >
     >```bash
     >yc lockbox secret create \
     >  --name sample-secret \
     >  --description sample_secret \
     >  --payload "[{'key': 'username', 'text_value': 'myusername'},{'key': 'avatar', 'binary_value': $(base64 -w 0 ./avatar.jpg)}]" \
     >  --cloud-id b1gwa87mbaom******** \
     >  --folder-id b1qt6g8ht345******** \
     >  --deletion-protection
     >```
     >
     >In this example, a secret is created with two keys: one with a text value and one with a binary value.
     >
     >Result:
     >
     >```text
     >id: e6q6nbjfu9m2********
     >folder_id: b1qt6g8ht345********
     >created_at: "2023-10-09T16:29:11.402Z"
     >...
     >    - username
     >    - avatar
     >deletion_protection: true
     >```

- Terraform {#tf}

  A secret only contains its own metadata, including its name, description, unique ID, etc. To start using a new secret, you need to [create its version](secret-version-manage.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. In the configuration file, describe the resources you want to create:

     ```hcl
     resource "yandex_lockbox_secret" "my_secret" {
       name                = "<secret_name>"
       description         = "<secret_description>"
       folder_id           = "<folder_ID>"
       kms_key_id          = "<encryption_key_ID>"
       deletion_protection = <deletion_protection_flag>
       labels              = {
         <label_1_key> = "<label_1_value>",
         <label_2_key> = "<label_2_value>"
       }
     }
     ```

     Where:
     * `name`: Secret name. This is a required setting.
     * `description`: Secret description. This is an optional setting.
     * `folder_id`: [ID](../../resource-manager/operations/folder/get-id.md) of the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create a secret. This is an optional setting.
     * `kms_key_id`: ID of the [Key Management Service](../../kms/concepts/key.md) encryption key used to encrypt your secret. If you do not specify a Key Management Service key, a special system key will be used to encrypt the secret. This is an optional setting.
     * `deletion_protection`: Deletion protection flag. To enable protection, set to `true`. To disable protection, set to `false`. The default value is `false`. This is an optional setting.
     * `labels`: Resource [label](../../overview/concepts/services.md#labels) in `<key>:"<value>"` format. This is an optional setting.

     For more information about `yandex_lockbox_secret` properties in Terraform, see [this provider guide](../../terraform/resources/lockbox_secret.md).
  1. Create the resources:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

  This will create a secret in the specified folder. You can check the new secret and its settings using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/index.md) command:

  ```bash
  yc lockbox secret get <secret_name>
  ```

- API {#api}

  To create a secret, use the [create](../api-ref/Secret/create.md) REST API method for the [Secret](../api-ref/Secret/index.md) resource or the [SecretService/Create](../api-ref/grpc/Secret/create.md) gRPC API call.

{% endlist %}

{% note tip %}

If you specified your KMS key when creating a secret, assign the [kms.keys.encrypterDecrypter](../../kms/security/index.md#service-roles) and [lockbox.payloadViewer](../security/index.md#roles-list) roles to your secret. They are required to access the key, as well as encrypt and decrypt it.

{% endnote %}