Conjur

Definition

Conjur is a secrets management tool from CyberArk, available in an open-source community edition and a commercial enterprise edition, that stores and controls access to credentials, API keys, and certificates used by applications, containers, and CI/CD pipelines. It authenticates workloads through identity-based policies rather than shared static credentials, issuing secrets to them at runtime, and complements CyberArk's broader privileged access management products which focus on human, not machine, identities.

Overview

Applications and automated pipelines need credentials, database passwords, cloud keys, service tokens, to operate, and a persistent challenge in infrastructure security is that these values tend to end up embedded in source code, configuration files, or container images where they are easy to leak and hard to rotate. Conjur was built to give machines the same kind of identity-based, policy-controlled access to secrets that identity and access management tools already gave human users, rather than relying on a shared static value everyone copies around. At its core, Conjur stores secrets encrypted at rest and exposes them only through an API that requires a requesting workload to first authenticate and prove its identity against a defined security policy, written in Conjur's declarative policy language as YAML. Policies define which hosts, applications, or roles may access which secrets, and Conjur supports authenticators tailored to common runtime environments, including Kubernetes service accounts, AWS IAM roles, Azure managed identities, and JWT-based authentication, so a workload doesn't need a separate bootstrap credential just to fetch its real ones. Conjur sits within the same secrets-management category as HashiCorp Vault and Akeyless, and it is the tool CyberArk built specifically for machine and application identities, complementing CyberArk's broader Privileged Access Manager suite, which focuses more on human privileged-account sessions. Where Vault is platform-agnostic open source with a large plugin ecosystem, Conjur's tightest integration story is with CyberArk's own vault and privileged access products, making it a natural fit for organizations already standardized on CyberArk for human privileged access who want matching controls for machine identities. In practice, teams deploy Conjur as a followed leader cluster for high availability, integrate it with Kubernetes via a sidecar or init-container pattern that injects secrets into pods at startup, and wire CI/CD systems to pull deployment credentials from it rather than storing them in pipeline configuration. The open-source edition covers core secrets storage and policy-based access, while the enterprise edition adds features like dynamic secrets rotation, expanded authenticator support, and centralized management alongside CyberArk's other privileged access products. The main trade-offs are the operational cost of running and maintaining Conjur's own infrastructure for the open-source edition, since unlike Akeyless it is not offered as a fully managed SaaS by default, and the learning curve of its YAML-based policy language, which is powerful for expressing fine-grained access rules but requires deliberate policy design to avoid overly broad grants as an environment scales.

Key Features

• Provides open-source community and commercial enterprise editions
• Authenticates workloads via Kubernetes, AWS IAM, Azure identities, or JWT
• Defines access rules in a declarative YAML policy language
• Encrypts secrets at rest and exposes them only through an authenticated API
• Integrates with Kubernetes via sidecar or init-container secret injection
• Complements CyberArk's Privileged Access Manager for machine identities
• Supports high-availability follower cluster deployments
• Enables CI/CD pipelines to fetch deployment credentials at runtime

Use Cases

Alternatives

Frequently Asked Questions

Related in Cybersecurity