PDR Crawler — Bitwarden Secrets Manager Setup

Machine account: secops-pipeline-crawler

Org: Pacific Debt Relief

Machine Account

Create a dedicated machine account in Bitwarden Secrets Manager:

Name: secops-pipeline-crawler
Purpose: Monthly infrastructure crawl — Azure Automation runbook
Owner: Max Simon (Director IT Ops)
Access: Read-only on pdr-infra-crawler secrets project

Secrets Project

Create a project in Bitwarden Secrets Manager: pdr-infra-crawler

Add the following secrets:

Secret Name	Description	Rotation
`TENANT_ID`	Azure AD tenant ID	Never
`CLIENT_ID`	SecOps-Pipeline-ReadOnly app reg client ID	Never
`CLIENT_SECRET`	App reg client secret	90 days
`BLOB_CONNECTION_STRING`	Azure Storage connection string for pdr-crawler	90 days
`ZENDESK_EMAIL`	Zendesk agent email for API auth	Never
`ZENDESK_API_TOKEN`	Zendesk API token	90 days
`ZENDESK_JUAN_ID`	Juan's Zendesk user ID (integer)	Never
`SLACK_BOT_TOKEN`	Bot OAuth token (xoxb-...) for #secops-pipeline	Never
`SLACK_CHANNEL_ID`	Target Slack channel ID	Never
`ANTHROPIC_API_KEY`	Anthropic API key for AI analysis	90 days

Getting Juan's Zendesk User ID

curl https://pacificdebt.zendesk.com/api/v2/users/search.json?query=juan \
  -u "your-email@pacificdebt.com/token:YOUR_API_TOKEN"

Pull the id field from the response for Juan's account.

Getting the Slack Webhook URL

Go to api.slack.com/apps
Select SecOps-Pipeline app
Incoming Webhooks → Add New Webhook to Workspace
Select #secops-pipeline channel
Copy the webhook URL → store in Bitwarden as SLACK_WEBHOOK_URL

Getting the Blob Connection String

az storage account show-connection-string `
  --name pdrcrawlerblob `
  --resource-group rg-secops-pipeline `
  --query connectionString `
  --output tsv

Store the full connection string in Bitwarden as BLOB_CONNECTION_STRING.

Rotation Schedule

90-day secrets must be rotated quarterly. Calendar reminders are mandatory — expired

secrets cause silent failures in scheduled runbooks.

Secret	Rotation Action	Owner
`CLIENT_SECRET`	Rotate in Azure AD app registrations → update Bitwarden + AA variable	Max
`BLOB_CONNECTION_STRING`	Regenerate storage key → update Bitwarden + AA variable	Juan
`ZENDESK_API_TOKEN`	Regenerate in Zendesk admin → update Bitwarden + AA variable	Juan
`ANTHROPIC_API_KEY`	Regenerate in Anthropic console → update Bitwarden + AA variable	Max

After each rotation: verify the old credential is dead (expect 401/403), then confirm

the runbook executes successfully on next scheduled run or via manual trigger.

Source: secops-pipeline/runbooks/bitwarden_setup.md | Last synced: 2026-03-23T08:24:35Z | Do not edit in Zendesk -- changes will be overwritten on next sync.