What is Secrets Management?
Storing, distributing, and rotating credentials like API keys and database passwords through controlled, audited systems instead of code or config files.
Definition
Secrets management covers the lifecycle of credentials — database passwords, API keys, TLS private keys, signing certificates — keeping them out of source code, Docker images, and .env files committed by accident. Dedicated stores like HashiCorp Vault, AWS Secrets Manager, and Kubernetes External Secrets encrypt secrets at rest, gate access with fine-grained policies, log every read, and automate rotation. Vault's dynamic secrets go further, minting short-lived database credentials per service so a leaked credential expires in minutes. The strongest pattern eliminates long-lived secrets entirely, using workload identity (IAM roles, OIDC federation) so services authenticate without stored keys.