Secret Management

A secrets manager keeps everything encrypted at rest using a master key, and that master key is itself protected. HashiCorp Vault, for example, starts sealed: the unseal key is split into several shares using Shamir's Secret Sharing, so no single operator can decrypt the store alone. Cloud managers like AWS Secrets Manager back the master key with a hardware security module through KMS.

To read a secret, a client must first prove who it is. This is the hard part, because the credential you use to authenticate is itself a secret, the so called secret zero problem. Real systems solve it with workload identity that is not a long lived password: an AWS IAM role attached to the instance, a Kubernetes service account token, or a short lived cloud identity token. The manager checks that identity against a policy, then hands back the secret over TLS.

Two features make these tools more than encrypted databases. Rotation lets the manager generate a brand new value on a schedule and update the downstream system, so a leaked secret is only useful for a short window. Dynamic secrets go further: Vault can create a fresh, unique database username and password for each client on request, valid for an hour, then delete it. There is no shared standing credential to steal.

Picture a payments service that needs to read from Postgres and call the Stripe API. Without secret management, both the database password and the Stripe key sit in an environment variable baked into the container image. When an engineer leaves the company, you would have to rebuild and redeploy every service to rotate those values, and most teams simply never do.

With Vault, the container starts with only a Kubernetes service account. It exchanges that token for a Vault token, then requests two things. For Stripe it reads a static secret, and Vault logs the read with a timestamp and the workload identity. For Postgres it requests a dynamic credential, and Vault connects to the database, creates a one hour user, and returns it. The service connects, and an hour later that database user no longer exists.

Now rotation is a config change, not a redeploy. If the Stripe key ever leaks, you revoke and replace it in one place and every consumer picks up the new value on its next fetch. The audit log tells your security team exactly which service read which secret and when, which is the evidence an auditor asks for.