How should you manage secrets in the cloud?

A secret is any credential that grants access: database passwords, API keys, private keys and tokens. The goal is to keep them out of source control and images, limit who and what can read them, and make rotation routine rather than an emergency.

Controls that matter

• Use a managed store such as Secrets Manager, Key Vault or Secret Manager
• Authorise access through workload identity, not shared static credentials
• Encrypt secrets with a customer-managed key when required
• Rotate automatically and support overlapping validity during rollout
• Audit every read and alert on unusual access patterns

const secret = await secretsClient.getSecretValue({
  SecretId: "prod/db",
});
const { password } = JSON.parse(secret.SecretString);

Environment variables are convenient but can leak through crash dumps, process listings and child processes. Fetching at runtime is better, and short-lived database credentials or token exchange remove long-lived secrets entirely.