TOPIC SECURITY
Secrets Management storing and rotating API keys, passwords, and certificates safely
IN 10 SECONDS
A secrets manager (Vault, AWS Secrets Manager, GCP Secret Manager) stores encrypted secrets and serves them on demand via API. Access is controlled by IAM policies. Secrets are never in code, config files, or environment variables at rest — they're fetched at runtime and rotated automatically.
GOTCHA If your app caches a secret indefinitely, rotation is useless — the old secret stays valid until the app restarts. Implement a watcher or periodic refresh to pick up new versions automatically.
HOW AN APP FETCHES A SECRET
01 App starts up and authenticates to the secrets manager using its IAM role or a short-lived token.
02 Secrets manager validates the identity, checks authorization policies, and audits the request.
03 Secrets manager decrypts the secret value and returns it over TLS to the app.
04 App caches the secret in memory (not disk) and uses it for the duration of its validity.
05 Rotation a scheduled function or Vault plugin generates a new credential, updates both the secret store and the target service (DB, API).
POKE IT YOURSELF
vault kv get secret/my-app/db — fetch a secret from Vault
aws secretsmanager get-secret-value --secret-id prod/db/password — get a secret from AWS Secrets Manager
Drill this topic →
~75 sec read