Unit 02 of 03
Secrets Management
How the keys and credentials an application carries are held at runtime is measured in numbers: the secret store's access matrix and the items that least privilege closes, the startup dependency the store opens as a single point, how many times a short-lived credential narrows the exposure window and the request load it brings in return, the minimum overlap during which two secrets are valid together in key rotation and the requests a wrong ordering cuts, the static secrets that workload identity eliminates and the external-system items that remain, and the minutes from detection to revocation in the leak-response flow and the calls made with the secret in that time.
Published Updated
Lessons
- 01 Secret Store Architecture The secret store is measured in terms of access control: the path-prefix policy opens 79 (app, secret) items to nine apps, the 90-day read log says 31, and 48 items sit there never used. No app reads three of the secrets; six apps can reach the widest data secret. The price of centralization is a single point — none of the nine apps can start without the store, and 41 start attempts a day pass through that one point. 14 min read
- 02 Short-Lived Credentials The time from the moment a secret leaks to the moment it expires on its own is measured: in 16 of 31 items the exposure window drops from 90 days to 64 minutes, a factor of 2,033; in the remaining 15 items it does not shrink at all, and after the move 99.96% of the total exposure gathers there. The cost is not the total of store requests but their distribution — the load of three apps grows by 6.3 to 14.5 times, 1,073 temporary credentials a day are born and die on the target systems, and the number of apps that go down in a two-hour store outage rises from four to eight. 15 min read
- 03 Key Rotation Rotation is measured in terms of the window in which two secrets stay valid together: the minimum overlap of seventeen secrets lies between 60 and 1,440 minutes, averages 815 minutes, and in eleven of them four apps that read only at startup set the window alone. When the overlap is kept short the arithmetic reverses — in a 60-minute window 36 clients miss the new value and 87,427 legitimate requests are cut, and when the order is reversed even the one app that reads on every request is cut. The same window drops from 1,440 minutes to 240 minutes when refresh-on-auth-failure is added. 15 min read
- 04 Workload Identity Workload identity is measured with a single number: how many static secrets it replaces. Twenty of the thirty-one items disappear, eleven remain, and all of the remainder gathers in six secrets — the keys that sit on the signature-verifying side and the external providers that do not support federation. Of the nine apps only two come to carry no static secret at all, and seven keep carrying at least one. The trust relation that replaces the secret does not reduce the item count; it reduces how leakable the item is — and when written at the group level it opens 36 pairs instead of 20. 14 min read
- 05 Leak Response Leak response is run as a revocation flow: across the remaining six static secrets, 1,386 minutes pass on average from the leak to revocation and 4,650 minutes in the worst item, and 224,171 calls pass through the secrets in that time. An ownership record gains 340 minutes and a pre-staged replacement gains 465; continuous repository scanning gains nothing because only two of the six leaks land in a repository. Revoking without waiting for propagation saves 150,934 calls but cuts 68,503 legitimate requests — one cut request for every 2.2 calls saved. 15 min read