sawrus/areas/software/platform/skills/secrets-management

Skill: Secrets Management

When to load

When provisioning a new service, rotating credentials, or setting up CI/CD secrets.

Secrets Hierarchy

Level 1: Static secrets (rotate quarterly)
  → AWS Secrets Manager / HashiCorp Vault
  → Database passwords, API keys for external services

Level 2: Dynamic secrets (auto-expire, 1 hour)
  → Vault dynamic secrets / AWS IAM OIDC roles

Level 3: Runtime injection (never on disk)
  → K8s ExternalSecrets Operator → mounts as env vars
  → Never in container image or Git

ExternalSecrets Pattern

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
spec:
  refreshInterval: 1h
  secretStoreRef: { kind: ClusterSecretStore, name: aws-secretsmanager }
  data:
    - secretKey: DATABASE_URL
      remoteRef: { key: prod/api/database, property: connection_string }
    - secretKey: STRIPE_SECRET_KEY
      remoteRef: { key: prod/api/stripe, property: secret_key }

Rotation Checklist

• [ ] New secret created, old secret still active
• [ ] Service updated to accept both (dual-read window)
• [ ] New secret deployed and verified
• [ ] Old secret revoked
• [ ] Rotation documented (next rotation: +90 days)