All terms
Glossary
Secrets management
Managing passwords, keys and credentials outside of code and configuration files.
Managed services such as AWS Secrets Manager or Parameter Store deliver credentials at runtime, log every access and allow rotation without a new deployment.
The gain is less in storing than in rotating: a key that cannot be swapped without a deployment will not be swapped when it matters.
How you notice it
- Credentials sit in configuration files or in code.
- Nobody knows who holds which key.
- Rotating one would mean touching everything.
Frequently asked
How often must credentials be rotated?
More important than the interval is whether rotation is possible at all without downtime. Anyone who has practised it once can do it in minutes when it counts. A fixed calendar without that ability only produces dates that get postponed.