Manage generation, storage, rotation, backup, and destruction.
Separate application access from human access.
Design recovery without creating a hidden master key.
A key lifecycle begins with generation and continues through activation, distribution, use, rotation, suspension, revocation, archival, and destruction. Secrets in source code, images, logs, or chat persist longer than expected. Central secret managers, access policies, audit trails, and short-lived credentials reduce exposure.
Rotation must be compatible with overlapping old and new keys, rollback, and recovery. Backups of encrypted data are useless if the keys are lost, but a broadly accessible backup key defeats isolation. Document custodians, dual control, and emergency procedures.
Exercises
Create a lifecycle for an API signing key.
Find secret leakage paths in a deployment pipeline.
Design break-glass access with approval and logging.
Self-check
Why rotate keys?
Why use short-lived credentials?
What is break-glass access?
Self-Check Quiz
1. Where should application secrets normally live?
AnswerIn a managed secret system with scoped access, auditability, and controlled rotation, not source code or committed configuration.
2. What must rotation include besides generating a new key?
AnswerDistribution, overlap or cutover, validation, revocation of the old key, rollback planning, and recovery testing.
Homework
Review the key lifecycle of a multi-service platform.
Specify access, rotation, and recovery controls.
Write an incident response step for a leaked credential.
Sample answerContain the credential, identify scope and use, revoke or disable it, issue a replacement through the secret manager, search logs and repositories for propagation, repair the leakage path, and document evidence and residual risk.