Secrets Management

💤0
Lv 10 XP
← 🔐 Security · Identity & Secrets

Secrets Management

Intermediate ⭐ 80 XP ⏱ 16 min #security#secrets#vault

Store, rotate, and deliver secrets securely across applications and pipelines.

📖Theory

A secrets manager (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) centrally stores credentials, keys, and tokens with encryption, access control, audit logging, and rotation. Apps fetch secrets at runtime instead of baking them into code or images.

The properties that matter:

  • Encryption at rest and in transit
  • Fine-grained access (which identity can read which secret) + audit trail
  • Rotation — change secrets regularly, ideally automatically
  • Dynamic secrets — generate short-lived, on-demand credentials (Vault’s signature feature) so there’s no long-lived secret to steal
🌍Real-World Example
# Read a secret at runtime (Vault)
export DB_PASS="$(vault kv get -field=password secret/app/db)"

# AWS Secrets Manager
aws secretsmanager get-secret-value --secret-id prod/db --query SecretString

# Dynamic secret: Vault issues a short-lived DB credential on demand
vault read database/creds/app-role   # username/password valid for 1h
✍️Hands-On Exercise
  1. List four properties a good secrets manager provides.
  2. Explain dynamic secrets and why they’re more secure than static ones.
  3. Describe the correct response to a secret accidentally committed to git.
  4. How should an app obtain a database password at runtime?
🧾Cheat Sheet▾
CapabilityDetail
Central storeVault / Secrets Manager / Key Vault
EncryptionAt rest + in transit
Access controlPer-identity, audited
RotationRegular, ideally automatic
Dynamic secretsShort-lived, on-demand creds
On leakRotate immediately
💬Common Interview Questions▾
What does a secrets manager provide over environment variables?

Centralized encrypted storage with fine-grained access control, audit logging, rotation, and often dynamic short-lived secrets — far stronger than static env vars or files.

What are dynamic secrets?

Credentials generated on demand with a short lifetime (e.g. a temporary database login), so there’s no long-lived secret to leak and access is automatically revoked.

📚Official Documentation

📝 My notes on this topic

Auto-saves as you type