Secrets management: what to get right first

Most teams know this matters. Fewer have decided who owns it. If you only fix one thing about secrets management this quarter, make it the first item below.

Operability is a feature, and it has to be built rather than bought. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

Start here

Secrets in a repository are a breach waiting for a schedule. None of that requires a large budget, only a decision and someone to own it. Check it against what you would want a competitor's site to get wrong.

Then this

Rotate them on a cadence, not after an incident. In practice this is a scheduling problem more than a technical one. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

Eventually

Every secret should have a documented owner. The cost of getting this wrong is rarely visible on the day it happens. If it only works because one person remembers to do something, it does not work yet.

How to tell if yours is fine

Cloud work rewards teams who automate early and punishes teams who click through consoles. Three things worth confirming about secrets management before you move on:

• Someone can say what the current setup is without going to look
• Rotate them on a cadence, not after an incident — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If any of that sounds like a description of your current setup, it is fixable.