What to ask your agency about secrets management

It is rarely the thing that gets a project approved, and often the thing that decides how it goes. If you are briefing an agency or a freelancer on secrets management, these questions are worth asking early.

Cloud work rewards teams who automate early and punishes teams who click through consoles. Write the reasoning down alongside the decision, because the reasoning is what changes first.

Questions worth asking

• Who will actually do this work, and have they done it before?
• How will we know afterwards whether it worked?
• What happens if it needs changing in a year?
• What are you assuming that we have not confirmed?

What a good answer sounds like

Secrets in a repository are a breach waiting for a schedule. There is a version of this that is over-engineered, and it is worth avoiding. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.

Every secret should have a documented owner. There is a version of this that is over-engineered, and it is worth avoiding. The version that survives contact with a real deadline is the simple one.

In practice

Operability is a feature, and it has to be built rather than bought. Three things worth confirming about secrets management before you move on:

• Someone can say what the current setup is without going to look
• Every secret should have a documented owner — and you know whether that is true here
• There is a way to tell whether the last change to this helped

If you are not sure where your systems currently stand on this, it takes us about an hour to find out.