Back to roadmap
Module 9 · Protocols, Security, ObservabilityDay 08720 min

Secrets Management

Don't put secrets in env files; rotate them like passwords.

← PreviousNext →
Day 087

Secrets Management

App
service
Secrets Mgr
service
DB
datastore
Signal path
Secrets fetched at runtime
App
service
flow
Secrets Mgr
service
App
service
flow
DB
datastore
Memory hook

Secrets Management: don't put secrets in env files

Mental model

design for the day something breaks

Design lens

Short-lived adds infra complexity.

Recall anchors
StorageRotationAudit

Why it matters

Secrets (DB passwords, API keys, signing keys) deserve their own infrastructure. A secrets manager stores, rotates, and audits access; apps fetch via short-lived creds.

Deep dive

Short-lived credentials (15-min IAM, mTLS-bound JWT) limit blast radius.

Rotate on schedule and on incident; tooling must support graceful overlap.

Audit reads; alert on unusual access patterns.

Demo / scenario

DB credentials in env files everywhere.

  1. Move to secrets manager with versioning.
  2. App reads via SDK at startup.
  3. Rotate quarterly with overlap window.
  4. Old version invalidated after deploy soak.

Tradeoffs

  • Short-lived adds infra complexity.
  • Apps must handle credential refresh.
  • Auditing is the long-term value.

Diagram

App
Secrets Mgr
DB
Secrets fetched at runtime.

Mind map

Check yourself

Loading quiz…

Sources & further reading

← PreviousNext →