DataTerminology.comNEW
Practices and tooling to securely store, distribute, rotate, and audit access to credentials, tokens, and other sensitive configuration.
DESCRIPTION
Secrets management governs how applications obtain sensitive credentials at runtime without hard-coding or insecure storage. Platforms like Vault and cloud secret stores provide secure storage, access policies, auditing, and rotation. Dynamic secrets reduce blast radius by issuing short-lived credentials. Integrations with KMS, IAM, and service identity (e.g., mTLS, OIDC) enable authentication without static passwords. Automating secret injection via sidecars or environment managers reduces developer burden. Strong logging and detection guard against leakage. Regular rotation and scoping minimize exposure.
ALTERNATIVE DEFINITIONS
HashiCorp
Vault secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing.
Emphasizes centralized control over diverse secret types.
Kubernetes
A Secret is an object that contains a small amount of sensitive data such as a password, a token, or a key.
Defines a platform-native abstraction for secret storage.
RELATED TERMS
Key Management Vault AWS Secrets Manager Kubernetes Secrets Zero Trust Least Privilege Dynamic Secrets Credential Rotation Service Account Mutual TLS Hardware Security Module OAuth 2.0 OpenID Connect Knowledge Management System
COMPETING TERMS
Environment Variable Configuration Management Hardcoded Secrets
RELATIONS
- Narrower: AWS Secrets Manager Azure Key Vault
KNOWLEDGE AREAS
Data Security Software Engineering Infrastructure Cloud
TARGET AUDIENCE
DevOps Engineer Software Developer Cloud Architect MLOps Engineer Data Engineer Security Architect Cybersecurity Engineer IT Manager
EXTERNAL SOURCES
- Wikipedia - Vault (software)
- HashiCorp - Vault product documentation
- AWS - AWS Secrets Manager overview
- OWASP - Secrets management best practices
TOP QUESTIONS
Why is Secrets Management necessary?
Hard-coded or scattered secrets lead to leaks and lateral movement. Centralized secrets management enforces least privilege, rotation, and auditing.
Category: Relevancy
What is a dynamic secret in Secrets Management?
A dynamic secret is generated on demand with a short TTL. It reduces long-term exposure and is automatically revoked.
Category: Definition
How should applications retrieve secrets?
Use short-lived identities (mTLS, OIDC) to authenticate to a secrets store. Inject secrets via sidecar, agent, or runtime API securely.
Category: Best practices
What are common Secrets Management mistakes?
Embedding secrets in code, committing them to Git, and overbroad access policies. Missing rotation and audit logging are also common.
Category: Mistakes
How does Secrets Management differ from Key Management?
Secrets Management handles broad credentials and delivery. Key Management focuses on cryptographic key lifecycle and controls.
Category: Misunderstanding
Can environment variables be used for secrets?
They are ubiquitous but risky without controls. Prefer ephemeral injection and restrict process-level access and logs.
Category: Opinion
How to rotate database credentials with minimal downtime?
Use dual credentials or dynamic users, apply grace periods, and roll services to pick up new credentials before revoking old ones.
Category: How-To
What telemetry should a secrets system provide?
Access logs, secret version use, policy changes, and anomaly alerts for unusual access patterns.
Category: Observability
How does zero trust relate to Secrets Management?
Zero trust requires strict identity verification and least privilege. Secrets systems enforce scoped, time-bound access aligned to that model.
Category: Overview