feat: dynamic secrets

[rohan-chaturvedi]

🔍 Overview

Adds Dynamic Secrets support, with AWS IAM as the first provider and architecture for additional providers in the future.

• Create, update and delete Dynamic Secrets at any path from the Console
• Create dynamic credentials for AWS IAM
• Manually revoke leases or let scheduled expiry revoke them on AWS
• Renew leases with custom TTLs
• View and manage leases with detailed logging
• RBAC for Lease management
• REST API to fetch, renew and revoke dynamic secrets and leases

🖼️ Screenshots or Demo

Configure a Dynamic Secret

Generate a lease

View and manage Leases

💚 Did You...

• Ensure linting passes (code style checks)?
  - [ ] Update dependencies and lockfiles (if required)
• Update migrations (if required)
• Regenerate graphql schema and types (if required)
• Verify the app builds locally?
• Manually test the changes on different browsers/devices?

---

Note

Introduce Dynamic Secrets with AWS IAM provider, leasing (create/renew/revoke), GraphQL/REST APIs, RBAC, and full Console UI; bump version to v2.52.0.

• Backend:
  • Models/Migrations: Add DynamicSecret, DynamicSecretLease, DynamicSecretLeaseEvent (+ fields for TTLs, status, credentials, key_map) with related migrations.
  • Auth/Access: Resolve environment via secret_id; extend RBAC with DynamicSecretLeases permissions.
  • APIs:
    • REST: New endpoints to list dynamic secrets and create/renew/revoke leases (ee.integrations.secrets.dynamic.rest).
    • GraphQL: Types/queries/mutations for providers, secrets, and leases (create/update/delete/lease/renew/revoke); environment resolvers include dynamic_secrets and counts include dynamic.
  • AWS Provider: Implement IAM user/key creation, tagging, policy/group attach, cleanup, scheduled revocation, and lease scheduling via RQ; utility/exception suite.
  • Utils/Serializers: Duplicate-check considers dynamic key_map; serializers for org member/service account and dynamic secrets/leases.
  • Views: Secrets endpoints optionally include dynamic secrets and can auto-create leases; logging/audit events added.
  • Routing/Settings: Wire GraphQL resolvers/mutations and REST URLs; version -> v2.52.0.
• Frontend:
  • Schema/Client: Regenerate GraphQL schema/types; add queries/mutations for dynamic secrets/leasing; cache policy for KeyMap.
  • UI: New Console flows to create/update/delete dynamic secrets, generate/renew/revoke leases, and view lease history (incl. environment and app listings); integrate dynamic secrets into env/app secrets views.
  • UX Tweaks: Minor component improvements (buttons, dialogs, inputs, progress bar, toggles, labels).

^{Written by Cursor Bugbot for commit a89ef7e. This will update automatically on new commits. Configure here.}

[nimish-ks]

@cursor review

[nimish-ks]

@cursor review