Secrets management

Secrets are API keys, database passwords, JWT signing keys, and anything else that an attacker could use to impersonate your service. The two rules are: never commit them to source control, and always have a way to rotate them without downtime.

Where secrets live in production. Environment variables injected at container startup (simple, works everywhere). A dedicated secrets manager like AWS Secrets Manager or HashiCorp Vault (safer, with rotation and audit). And platform-native features like Kubernetes Secrets. Each has tradeoffs, all are better than hardcoding.

Rotation is the part most teams skip until they wish they had not. A secret that has never been rotated is a ticking clock. A good rotation story supports two valid secrets at once for a short window, so you can roll out the new one without a hard cutover. The cost of setting this up is small. The cost of not having it the first time you need to rotate a leaked key is enormous.

Quiz: Quiz

Loading practice…