Working with Secret Management
1. Understanding Secret Management Concepts
| Concept | Detail |
|---|---|
| Secret | Credentials, keys, tokens, certs |
| Lifecycle | Generate → distribute → rotate → revoke |
| Zero-knowledge | Secret never persists in code/logs |
| Just-in-time | Issued at runtime, short-lived |
2. Storing Secrets in Environment Variables
| Pro / Con | Detail |
|---|---|
| Pro | 12-factor; simple |
| Con | Visible in /proc/PID/environ, crash dumps, child processes |
| Better | Read at boot, then unset; or use secret store |
3. Using HashiCorp Vault
Example: KV v2 + dynamic DB creds
vault kv put secret/app/db password=$(openssl rand -hex 16)
vault read database/creds/app-role # JIT user+password, TTL 1h| Feature | Detail |
|---|---|
| Engines | KV, PKI, transit, dynamic DB/AWS/cloud |
| Auth | AppRole, JWT, Kubernetes ServiceAccount |
| Lease | Auto-revocation on expiry |
4. Implementing AWS Secrets Manager
| Feature | Detail |
|---|---|
| Rotation | Lambda-based, native for RDS |
| Access | IAM policy |
| Encryption | KMS |
| SDK | GetSecretValue with cache |
5. Using Azure Key Vault
| Type | Detail |
|---|---|
| Secrets | Strings up to 25KB |
| Keys | Crypto operations (HSM-backed: Premium tier) |
| Certificates | Auto-renew (e.g., from DigiCert) |
| Access | Managed Identity + RBAC |
6. Implementing GCP Secret Manager
| Feature | Detail |
|---|---|
| Versions | Immutable; rotate via new version |
| Access | IAM per secret |
| Replication | Auto multi-region |
| Workload Identity | GKE pods auth without keys |
7. Implementing Secret Rotation
| Pattern | Detail |
|---|---|
| Dual-version | Old + new active during cutover |
| Notify consumers | Event/webhook on rotation |
| Cache TTL | Short — re-fetch frequently |
| Automation | Scheduler triggers rotation Lambda |
8. Encrypting Secrets at Rest
| Layer | Detail |
|---|---|
| Storage | AES-256-GCM |
| Key | KMS / HSM-managed DEK + KEK envelope |
| Rotation | Re-encrypt with new KEK periodically |
9. Managing API Keys Securely
| Practice | Detail |
|---|---|
| Never in repo | git-secrets, gitleaks pre-commit hooks |
| Per-environment | Separate keys per env, never share prod |
| Scoped | Minimum permissions / IP allowlist |
| Leak monitoring | GitHub secret scanning, Trufflehog |
10. Implementing Secret Access Policies
| Control | Detail |
|---|---|
| Least privilege | Per-secret IAM grants |
| Audit | All reads logged (CloudTrail, Vault audit device) |
| MFA | Required for human secret access |
| Break-glass | Emergency procedure with after-the-fact review |