Mental model#
A secret is high-impact credential material such as an API key, private key, or password. Manage its creation, scoped delivery, use, rotation, revocation, and audit as one lifecycle; a secure vault does not help if applications copy values into code, logs, images, or support tools.
Mechanism and state flow#
- Inventory secret consumers and replace shared human credentials with workload identity where possible.
- Generate high-entropy material in an approved system and assign least-privilege policy.
- Deliver at runtime over an authenticated channel; keep it out of source, build arguments, images, URLs, and telemetry.
- Rotate with overlap or versioning so producers and consumers move without outage.
- Revoke, audit use, scan for accidental copies, and rehearse compromise recovery.
Concrete example#
Rotate a database credential without stopping writes
Create a second scoped credential, update workloads to prefer it, verify old-credential use falls to zero, then revoke the first. Connection pools and long-running jobs are included in the observation window.
Architecture consequence: Support overlapping versions and usage telemetry; rotation is a distributed rollout rather than one value replacement.
Scaling and operational trade-offs#
| Option | Choose when | Cost or limit |
|---|---|---|
| Dynamic short-lived credential | The platform can authenticate workloads and issue scoped access. | The issuer becomes a runtime dependency and renewal must be reliable. |
| Static managed secret | An external system cannot support workload identity. | Rotation, copying, and compromise duration require tighter operations. |
| Shared secret | Avoid when per-workload identity is available. | Attribution and revocation have a large blast radius. |
Failure diagnosis#
- Failure
- A third-party key appears in an application error log.
- Impact
- Anyone with log access may impersonate the service until the key is revoked.
- Detection
- Secret scanning and unusual provider usage identify the value and affected scope.
- Mitigation
- Revoke first, issue a replacement through the managed path, restrict affected logs, and fix redaction at the source.
- Trade-off
- Emergency revocation may interrupt dependent work while credentials roll.
Checklist exercise#
Work the scenario before revealing your answer
- Map generation, storage, delivery, memory use, logging, rotation, revocation, and deletion for one credential.
- Name every consumer and reduce its permissions to the required operations.
- Write the first three steps after suspected exposure; do not begin with investigation that leaves the key active.
Level calibration#
| Level | Useful evidence |
|---|---|
| SDE I–II | Keep credentials out of source and logs; consume the managed runtime path. |
| Senior | Design scoped identity, rotation, revocation, and recovery for a service. |
| Staff | Reduce organization-wide secret inventory and define ownership, audit, cost, and incident policy for the platform. |
Use these prompts to extend the design. The useful answer is a reasoned change, not a memorized sentence.
- Can workload identity remove this secret?
- How does rotation avoid downtime?
- Where can the value be copied accidentally?
- What is the blast radius and revocation time?
Related practice problems
Use the manifest-backed prompts below to apply this lesson in a complete design.
Sources reviewed 2026-09-04. Product-specific controls and threat assumptions still require current verification.