TOPIC SECURITY
Secrets Rotation keys that expire on purpose
IN 10 SECONDS
The security process of periodically invalidating API keys and passwords, replacing them with new ones to limit the window of opportunity if credentials are leaked.
GOTCHA Hardcoding secrets in environment variables breaks rotation because apps must be manualy restarted to load new configurations.
HOW AN AUTOMATED ROTATION FLOWS
01 Schedule task secrets manager triggers rotation schedule (e.g. every 90 days).
02 New credential database manager generates a secondary password.
03 Swap update secrets manager writes the secondary password to active app configurations.
04 Revoke old after app restarts, database manager revokes the old password.
POKE IT YOURSELF
aws secretsmanager rotate-secret --secret-id my-secret — manually trigger immediate rotation of a secret
Drill this topic →
~70 sec read