Course Preview

Secrets Management

Secrets management is the controlled storage, delivery, rotation, revocation, and auditing of credentials such as passwords, API keys, tokens, certificates, and encryption keys. It keeps sensitive values out of source code and gives each workload only the secret it needs for a limited time.

itIdentity, access, and cryptography | OpenSkills.info

Secrets Management

A secret is a value whose possession grants access or enables a protected operation. Database passwords, API keys, signing keys, private keys, and bearer tokens are common examples. Secrets management controls these values from creation through revocation and destruction.

The useful mental model is identity requests capability, policy permits access, and a broker delivers a bounded secret.

human or workload identity
          |
          v
 authentication -> authorization policy -> secret broker
                                            |       |
                                      audit event   version
                                            |       |
                                            v       v
                                      protected service

The broker may be a managed cloud service, a self-hosted vault, a platform facility, or an encrypted-file workflow. The architecture matters less than the controls it preserves: authenticated access, least privilege, encryption, versioning, rotation, revocation, availability, and useful audit records.

Why configuration storage is not enough

Ordinary configuration tells software how to behave. A secret proves authority. Copying a database password into source code, an image, a ticket, or a shared configuration file creates another uncontrolled credential copy.

Encryption at rest protects stored bytes from some storage-layer disclosure. It does not decide which workload may retrieve a secret, prevent an authorized process from logging it, or rotate the credential at the system that accepts it. Secrets management combines protected storage with identity, policy, delivery, lifecycle, and evidence.

Base64 encoding is not encryption. Environment variables are a delivery mechanism, not a vault. A Kubernetes Secret is intended for confidential data, but its values require encryption at rest, restrictive role-based access control, and careful container scoping. The application must still protect a value after reading it.

The control path

Secrets management begins before a value exists.

Continue the course

This section is part of the paid course.

See pricing to subscribe, or log in if you already have access.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Backend Engineersupporting

Sources