What Is Secret Management

Secret management is the practice of securely storing, distributing, and rotating sensitive information such as passwords, API keys, database connection strings, TLS certificate private keys, and encryption keys.

Secret leaks can lead to serious security incidents. AWS access keys committed to public GitHub repositories can be found by bots and used without authorization, for example for cryptocurrency mining. Secret management is a foundational element of security that helps reduce such incidents.

Secret Management Tools and Selection Criteria

Dedicated tools and services should be used for secret management. Storing secrets directly in environment variable settings and hard-coding them in source code should be avoided due to high leak risk and lack of auditability.

HashiCorp Vault: An open-source secret management tool. Supports dynamic secrets (disposable credentials), fine-grained access policies, and multiple authentication backends. Ideal for multi-cloud and hybrid environments
AWS Secrets Manager: A managed service deeply integrated with AWS. Supports automatic rotation for RDS, Redshift, and DocumentDB credentials. Integrates with Lambda for custom rotation logic
Azure Key Vault: Manages secrets, encryption keys, and certificates in a unified manner. Integrates with Microsoft Entra ID (formerly Azure AD) for access control. Supports HSM-backed key storage
SOPS (Secrets OPerationS): Encrypts secret files and manages them in Git. Supports AWS KMS, GCP KMS, and Azure Key Vault as encryption backends

Secret Lifecycle Management

Secrets are not "set and forget"; their entire lifecycle must be managed.

Generation: Generate random values with sufficient entropy. Never use human-created passwords or guessable patterns
Distribution: When passing secrets to applications, use environment variable injection, file mounting, or API retrieval from secret management services. Never include secrets in container images or deployment artifacts
Rotation: Regularly rotate secrets to minimize the impact window if leaked. Automate rotation and design applications to handle credential changes without downtime (e.g., dual-credential support during transition periods)
Revocation: Immediately revoke secrets when leaks are detected or personnel changes occur. Pre-establish and automate revocation procedures so that revocation can be carried out quickly
Auditing: Log all secret access and regularly review who accessed what and when. Detect anomalous access patterns (access from unusual times or IP addresses) and trigger alerts

Secret Leak Detection and Response

Mechanisms for early detection of secret leaks and minimizing damage are also important.

Git Secret Scanning: Use tools like git-secrets, truffleHog, or GitHub Secret Scanning to detect secret inclusion before commits or at push time. Integrating them into pre-commit hooks can catch secrets before they are committed
Runtime Monitoring: Monitor for anomalous API call patterns using leaked credentials. AWS CloudTrail and GuardDuty can detect suspicious activity associated with access keys
Incident Response Playbook: Pre-define response procedures for secret leaks. The basic flow is: immediate revocation of the leaked secret → impact assessment → credential rotation for affected systems → root cause analysis and recurrence prevention

To learn more about this topic, see Cloud Storage Security: How to Keep Your Data Safe in the Cloud.

Common Misconceptions

Storing secrets in environment variables is secure: Environment variables can leak through the /proc filesystem, crash dumps, and log output. While environment variables can serve as a temporary transfer mechanism for values retrieved from secret management services, they are unsuitable as a permanent storage location.
Encrypting secrets and committing them to a repository is fine: Managing the encryption key becomes a new challenge, and if the key leaks, all secrets can be decrypted. Additionally, secrets persist in Git history, requiring past commits to be addressed during key rotation. Use dedicated secret management services instead.

Secrets Management