Secrets Management
The practice of securely storing and managing sensitive information like API keys, passwords, and certificates.
Detailed Explanation
Secrets should never be hardcoded or committed to version control. Professional secrets management involves using dedicated tools (like HashiCorp Vault, AWS Secrets Manager, or GitHub Secrets) that encrypt data at rest, provide audit logs, and allow for automated secret rotation. This is a critical security layer for modern cloud applications.
Quick Summary
Secrets management centralizes storage, access control, and rotation of credentials, API keys, database passwords, TLS certs, signing keys, so applications fetch them at runtime instead of hardcoding or committing them.
Key Takeaways
- Three principles: encryption at rest, fine-grained access control (per-app, per-role), and audit logs of every read.
- Rotation is the long-term value, secrets should change on a schedule and on suspicion of compromise, with no app downtime.
- Use workload identity (IAM roles, K8s service accounts) to authenticate apps to the secrets store, not a static "master" credential.
- Tools: HashiCorp Vault (self-hosted), AWS/GCP/Azure Secrets Manager, Doppler, Infisical, 1Password Secrets, SOPS for git-encrypted files.
- A leaked secret is not an emergency only if you can rotate it in minutes; design for that from the start.
When to use it
- Injecting DB passwords and third-party API keys into apps at deploy time.
- Issuing short-lived database credentials per request or per session.
- Storing TLS certificates with automated renewal (Let's Encrypt, ACM).
- Rotating signing keys for JWTs, webhooks, and code signing on a schedule.
Common Mistakes
- Storing secrets in environment variables baked into Docker images, they leak into image layers and CI logs.
- Committing `.env` files "just for staging" and forgetting they contain real prod-adjacent credentials.
- Logging requests/responses verbatim, secrets in URLs or bodies end up in log indexes forever.
- No rotation plan, so when (not if) a secret leaks, the response is panic and downtime.
Secrets Management, Frequently Asked
Vault vs. cloud-native secret managers?
HashiCorp Vault is the most powerful, with dynamic credentials, transit encryption, and SSH/PKI features, at the cost of operational complexity. Cloud-native (AWS/GCP/Azure Secrets Manager) is simpler if you're already on that cloud and don't need Vault's advanced features.
How often should I rotate secrets?
Long-lived shared secrets: every 30–90 days. Anything potentially exposed: immediately. Best practice is to design for dynamic, short-lived credentials (Vault dynamic DB creds, AWS STS) so rotation is automatic instead of a manual chore.
Are GitHub Secrets enough for my project?
Fine for CI/CD secrets (deploy keys, npm tokens), they're encrypted and audit-logged. For application runtime secrets at scale, graduate to a dedicated secrets manager that supports rotation and per-workload access.