Credentials and keys.
WHAT THE SECRET MANAGER PROVIDES
Storage for secrets, with versioning, access control and audit logging.
WHAT TO PUT THERE
API keys for third-party services Database credentials Signing keys Anything that would otherwise sit in configuration
WHAT TO NEVER DO
Commit secrets to a repository Put secrets in environment variables defined in committed files Put secrets in container images
WHY
They persist in history and in image layers permanently.
HOW APPLICATIONS SHOULD ACCESS THEM
Using the identity attached to the resource, granted access to the specific secret.
WHY THAT MATTERS
No credential is needed to obtain the credential.
WHAT TO CONFIGURE
Access at the level of individual secrets, not the project Rotation, where the underlying service supports it Alerting on access from unexpected identities
WHAT VERSIONING PROVIDES
Rotating a secret while the previous version remains available.
WHY THAT MATTERS
It allows rotation without a coordinated restart.
WHAT TO AUDIT
Who and what has accessed each secret.
WHAT TO DO IF A SECRET WAS EXPOSED
Rotate it, assuming compromise, and review what it could reach.
