What it means
A secret is information whose possession can grant access or enable a sensitive operation: a password, private key, application programming interface (API) token, or signing credential. Managing secrets covers their whole lifecycle, from creation and distribution to use, rotation, revocation, and disposal. A dedicated store can centralize access controls and audit records, but applications still need a secure way to obtain secrets and handle them in memory. Short-lived workload credentials can reduce reliance on long-lived copied keys. Ownership matters because an unexplained credential is difficult to rotate safely when an incident occurs.
AN ILLUSTRATIVE SCENARIO
A shipping integration needs a token
A retailer connects its order service to a carrier. Instead of adding the carrier token to source code, the team stores it in an approved secrets service and lets the order workload retrieve only that token. The token's permissions cover the required shipping actions. Logs record retrieval without exposing its value. During a rotation exercise, the team updates the application, verifies shipments using a test order, and revokes the old credential after the replacement is working.
Put it to work
- Inventory application and administrative secrets, including their owners, permissions, consumers, and expiry. Prioritize credentials embedded in code, shared documents, build output, or manual deployment notes.
- Use an approved store and workload identity where possible. Limit retrieval to the necessary application and people, protect delivery, and prevent secret values from appearing in logs or support tickets.
- Practice rotation and emergency revocation, including dependent services and rollback constraints. When a secret is exposed, replace and revoke it; removing the visible copy does not invalidate copies already taken.
How to check your work
Using test credentials, confirm an authorized workload can retrieve only its own secret, an unrelated workload is denied, and the old value stops working after rotation. Check that audit records explain access without containing the credential itself.
Connect the ideas
- Least privilege
Granting each identity only the actions, objects, and time window required for the current job.
- Encryption
Transforming data so only holders of the appropriate key can read it, protecting confidentiality in transit or at rest.
- Blast radius
How much additional loss a failure or a response action can cause beyond the original asset.