Secrets Management Best Practices

Overview

Secrets management protects sensitive values such as API keys, database passwords, and certificates.

Best Practices

• Store secrets in dedicated secret stores
• Rotate secrets regularly
• Use least-privilege secret access
• Audit secret access and changes

flowchart LR
    A[Application] --> B[Secret Manager]
    B --> C[Short-lived Secret]
    C --> A

Practical Example

env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: app-db-credentials
        key: password

Production Example

Platform teams often issue short-lived database credentials through dynamic secret engines to reduce lateral movement risk.

Common Pitfalls

• Committing secrets to source control
• Long-lived shared credentials
• Missing revocation workflow after incident

Key Takeaways

• Dedicated secret storage is mandatory in modern systems.
• Rotation and audit trails reduce breach impact.
• Runtime injection is safer than static configuration files.