Secrets Management — Cheat Sheet

Tags: security, vault, secrets-management, devops, env-vars, kms

Level: intermediate

TL;DR: Centralize credentials outside code repositories, enforce encryption at rest and in transit, and automate rotation with strict principle of least privilege.

Key concepts

Never commit credentials, API tokens, private keys, or passwords to source control.

Separate configuration data from secrets across environments.

Inject secrets dynamically via environment variables or encrypted file mounts at runtime.

Implement short-lived credentials and automated rotation policies.

Encrypt secrets in transit using TLS and at rest using KMS envelopes.

Enforce strict role-based access control and least-privilege scoping per workload.

Maintain immutable audit logs for every secret access and modification event.

Use pre-commit hooks and static analysis scanning in CI pipelines.

Typical questions and ready answers

Q: How do you prevent sensitive credentials from leaking into Git repositories?R: I enforce local pre-commit hooks with scanning tools like gitleaks, block commits via CI pipeline gates, and ensure developers load credentials dynamically via centralized secret stores or local untracked .env files.

Q: What is the difference between secret management services and plain environment variables?R: Plain environment variables can leak through process dumps, crash reports, or child processes; dedicated vaults provide fine-grained access control, encryption at rest, automatic rotation, and full audit trails.

Q: How do you handle secret rotation with zero downtime?R: I keep the previous credential version valid alongside the newly generated version until all downstream services acknowledge and adopt the new secret, after which the old credential is decommissioned.

Pitfalls and common mistakes

Hardcoding fallback credentials directly in development configuration files.

Baking secret values directly into public or internal Docker images during build time.

Logging full error exceptions or request headers containing bearer tokens and API keys.

Passing sensitive secrets as Docker build arguments visible in image history layers.

Granting wide read permissions across unrelated environments rather than granular scopes.

Snippets and commands

# Scan repository history for committed credentials and keys
gitleaks detect --source . --verbose

Bash

# Fetch a specific secret from HashiCorp Vault via CLI
vault kv get -field=api_key secret/data/production/crm

YAML

# Kubernetes Secret volume mount pattern
apiVersion: v1
kind: Pod
metadata:
  name: backend-service
spec:
  containers:
    - name: api
      image: node:20-alpine
      volumeMounts:
        - name: secret-volume
          mountPath: /etc/secrets
          readOnly: true
  volumes:
    - name: secret-volume
      secret:
        secretName: api-db-credentials

To review

[ ] HashiCorp Vault AppRole authentication workflow

[ ] AWS Secrets Manager vs Parameter Store pricing and rotation triggers

[ ] Sealed Secrets and External Secrets Operator implementations in Kubernetes

[x] Basic pre-commit secret scanning hooks and CI gates