Secrets Management

Store and rotate credentials in a vault instead of hardcoding them.

secrets

Detailed Description

Secrets should not live in source code, container images, or plain environment dumps.

A vault provides access control, audit logs, versioning, and rotation workflows.

Visual Diagram

Secrets Vault Pattern
  ✗ Bad:  DB_PASS=secret123 in code / env

  ✓ Good: HashiCorp Vault
    Service → authenticate to Vault
    Vault   → return secret (time-limited)
    Service → use secret, auto-renew

  Rotation: new secret → services pick up
  automatically without redeploy

Tradeoffs

Pros

Centralized rotation and audit

Cons

Vault availability and integration complexity

Examples: HashiCorp Vault, AWS Secrets Manager, encrypted K8s Secrets