Secrets Management

---

Secrets are digital credentials like keys, API tokens, passwords, and certificates used to provide access to services and systems where encryption or validation of identity are required.

Secrets management is the use of tools and techniques to create, store, and manage the lifecycle of secrets.

• cloud providers typically offer secrets management services
• e.g.,
  • Google Secret Manager
  • Azure Key Vault
  • Amazon Secrets Manager
• also built into the development process
  • OWASP Secrets Management Cheatsheet
    • ensure availability
    • importance of centralization and standardization
    • best practices for automation
    • access controls
    • auditing guidelines
    • outline of secrets lifecycle
    • policies, metadata, and CI/CD pipeline