{
  "code": null,
  "collection": "architecture",
  "href": "https://banes-lab.com/ontology#architecture-secrets-management",
  "id": "secrets-management",
  "kind": "activity",
  "layer": {
    "href": "https://banes-lab.com/ontology/schema#layer-security-core",
    "json": "https://banes-lab.com/json/records/layer/security-core",
    "label": "Security Core",
    "markdown": "https://banes-lab.com/records/layer/security-core.md",
    "ref": "layer:security-core"
  },
  "name": "Secrets Management",
  "ref": "architecture:secrets-management",
  "relations": [
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-secret-store",
          "json": "https://banes-lab.com/json/records/lexicon/secret-store",
          "label": "Secret Store",
          "markdown": "https://banes-lab.com/records/lexicon/secret-store.md",
          "ref": "lexicon:secret-store"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-rotation-policy",
          "json": "https://banes-lab.com/json/records/lexicon/rotation-policy",
          "label": "Rotation Policy",
          "markdown": "https://banes-lab.com/records/lexicon/rotation-policy.md",
          "ref": "lexicon:rotation-policy"
        }
      ],
      "relation": "requires"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-secure-configuration",
          "json": "https://banes-lab.com/json/records/lexicon/secure-configuration",
          "label": "Secure Configuration",
          "markdown": "https://banes-lab.com/records/lexicon/secure-configuration.md",
          "ref": "lexicon:secure-configuration"
        }
      ],
      "relation": "reinforces"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-safe-credential-handling",
          "json": "https://banes-lab.com/json/records/lexicon/safe-credential-handling",
          "label": "Safe Credential Handling",
          "markdown": "https://banes-lab.com/records/lexicon/safe-credential-handling.md",
          "ref": "lexicon:safe-credential-handling"
        }
      ],
      "relation": "enables"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-hardcoded-secrets",
          "json": "https://banes-lab.com/json/records/lexicon/hardcoded-secrets",
          "label": "Hardcoded Secrets",
          "markdown": "https://banes-lab.com/records/lexicon/hardcoded-secrets.md",
          "ref": "lexicon:hardcoded-secrets"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-secret-sprawl",
          "json": "https://banes-lab.com/json/records/architecture/secret-sprawl",
          "label": "Secret Sprawl",
          "markdown": "https://banes-lab.com/records/architecture/secret-sprawl.md",
          "ref": "architecture:secret-sprawl"
        }
      ],
      "relation": "conflicts-with"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-operational-complexity",
          "json": "https://banes-lab.com/json/records/lexicon/operational-complexity",
          "label": "Operational Complexity",
          "markdown": "https://banes-lab.com/records/lexicon/operational-complexity.md",
          "ref": "lexicon:operational-complexity"
        }
      ],
      "relation": "tensions-with"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#tension-operational-complexity-secrets-management",
          "json": "https://banes-lab.com/json/records/tension/operational-complexity-secrets-management",
          "label": "Secrets Management / Operational Complexity",
          "markdown": "https://banes-lab.com/records/tension/operational-complexity-secrets-management.md",
          "ref": "tension:operational-complexity-secrets-management"
        }
      ],
      "relation": "tensions"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/algorithms#algorithms-no-hardcoded-secrets",
          "json": "https://banes-lab.com/json/records/algorithms/no-hardcoded-secrets",
          "label": "Secret Store Over Hardcoded Secrets",
          "markdown": "https://banes-lab.com/records/algorithms/no-hardcoded-secrets.md",
          "ref": "algorithms:no-hardcoded-secrets"
        }
      ],
      "relation": "contracts"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-secret-sprawl",
          "json": "https://banes-lab.com/json/records/architecture/secret-sprawl",
          "label": "Secret Sprawl",
          "markdown": "https://banes-lab.com/records/architecture/secret-sprawl.md",
          "ref": "architecture:secret-sprawl"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-hardcoded-secrets",
          "json": "https://banes-lab.com/json/records/lexicon/hardcoded-secrets",
          "label": "Hardcoded Secrets",
          "markdown": "https://banes-lab.com/records/lexicon/hardcoded-secrets.md",
          "ref": "lexicon:hardcoded-secrets"
        }
      ],
      "relation": "violated-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-secret-rotation",
          "json": "https://banes-lab.com/json/records/lexicon/secret-rotation",
          "label": "Secret Rotation",
          "markdown": "https://banes-lab.com/records/lexicon/secret-rotation.md",
          "ref": "lexicon:secret-rotation"
        }
      ],
      "relation": "refactored-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology/schema#vocabulary-severity-mandatory",
          "json": "https://banes-lab.com/json/records/vocabulary/severity-mandatory",
          "label": "mandatory",
          "markdown": "https://banes-lab.com/records/vocabulary/severity-mandatory.md",
          "ref": "vocabulary:severity-mandatory"
        }
      ],
      "relation": "severity"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/ontology#architecture-category-security-privacy-compliance-governance",
          "json": "https://banes-lab.com/json/records/architecture-category/security-privacy-compliance-governance",
          "label": "Security / Privacy / Compliance / Governance",
          "markdown": "https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md",
          "ref": "architecture-category:security-privacy-compliance-governance"
        }
      ],
      "relation": "category"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/anatomy/governance#file-governance-rules-eslint-no-secret-value-eslint-rule-ts",
          "json": "https://banes-lab.com/json/source/governance/rules/eslint/no-secret-value.eslint.rule.ts",
          "label": "rules/eslint/no-secret-value.eslint.rule.ts",
          "markdown": "https://banes-lab.com/source/governance/rules/eslint/no-secret-value.eslint.rule.ts.md",
          "ref": "anatomy:file-governance-rules-eslint-no-secret-value-eslint-rule-ts"
        },
        {
          "href": "https://banes-lab.com/anatomy/scripts#file-scripts-runtime-entrypoints-credential-entrypoint-ts",
          "json": "https://banes-lab.com/json/source/scripts/runtime/entrypoints/credential.entrypoint.ts",
          "label": "runtime/entrypoints/credential.entrypoint.ts",
          "markdown": "https://banes-lab.com/source/scripts/runtime/entrypoints/credential.entrypoint.ts.md",
          "ref": "anatomy:file-scripts-runtime-entrypoints-credential-entrypoint-ts"
        }
      ],
      "relation": "enforced-by"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/disciplined-methodology/ship#the-deploy-is-a-file-operation",
          "json": "https://banes-lab.com/json/disciplined-methodology/ship/the-deploy-is-a-file-operation",
          "label": "The deploy is a file operation",
          "markdown": "https://banes-lab.com/disciplined-methodology/ship/the-deploy-is-a-file-operation.md",
          "ref": "chapter:/disciplined-methodology/ship#the-deploy-is-a-file-operation"
        },
        {
          "href": "https://banes-lab.com/ontology#architecture-category-anti-patterns",
          "json": "https://banes-lab.com/json/ontology/principles/architecture-category-anti-patterns",
          "label": "Anti-patterns",
          "markdown": "https://banes-lab.com/ontology/principles/architecture-category-anti-patterns.md",
          "ref": "chapter:/ontology#architecture-category-anti-patterns"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-category-core-vocabulary",
          "json": "https://banes-lab.com/json/ontology/lexicon/lexicon-category-core-vocabulary",
          "label": "Core Vocabulary",
          "markdown": "https://banes-lab.com/ontology/lexicon/lexicon-category-core-vocabulary.md",
          "ref": "chapter:/ontology/lexicon#lexicon-category-core-vocabulary"
        },
        {
          "href": "https://banes-lab.com/ontology/lexicon#lexicon-category-security-privacy-compliance",
          "json": "https://banes-lab.com/json/ontology/lexicon/lexicon-category-security-privacy-compliance",
          "label": "Security Privacy Compliance",
          "markdown": "https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md",
          "ref": "chapter:/ontology/lexicon#lexicon-category-security-privacy-compliance"
        },
        {
          "href": "https://banes-lab.com/ontology/algorithms#algorithms-domain-architectural-rules",
          "json": "https://banes-lab.com/json/ontology/algorithms/algorithms-domain-architectural-rules",
          "label": "Architectural Rules",
          "markdown": "https://banes-lab.com/ontology/algorithms/algorithms-domain-architectural-rules.md",
          "ref": "chapter:/ontology/algorithms#algorithms-domain-architectural-rules"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-vocabulary-severity",
          "json": "https://banes-lab.com/json/ontology/schema/the-vocabulary-severity",
          "label": "Severity levels",
          "markdown": "https://banes-lab.com/ontology/schema/the-vocabulary-severity.md",
          "ref": "chapter:/ontology/schema#the-vocabulary-severity"
        },
        {
          "href": "https://banes-lab.com/ontology/schema#the-resolutions",
          "json": "https://banes-lab.com/json/ontology/schema/the-resolutions",
          "label": "The resolutions",
          "markdown": "https://banes-lab.com/ontology/schema/the-resolutions.md",
          "ref": "chapter:/ontology/schema#the-resolutions"
        }
      ],
      "relation": "linked-from"
    },
    {
      "links": [
        {
          "href": "https://banes-lab.com/anatomy/secrets#file-secrets-core-resolvers-environment-resolver-ts",
          "json": "https://banes-lab.com/json/source/secrets/core/resolvers/environment.resolver.ts",
          "label": "textOf",
          "markdown": "https://banes-lab.com/source/secrets/core/resolvers/environment.resolver.ts.md",
          "ref": "anatomy:file-secrets-core-resolvers-environment-resolver-ts"
        },
        {
          "href": "https://banes-lab.com/anatomy/secrets#file-secrets-core-resolvers-environment-resolver-ts",
          "json": "https://banes-lab.com/json/source/secrets/core/resolvers/environment.resolver.ts",
          "label": "portOf",
          "markdown": "https://banes-lab.com/source/secrets/core/resolvers/environment.resolver.ts.md",
          "ref": "anatomy:file-secrets-core-resolvers-environment-resolver-ts"
        }
      ],
      "relation": "evidence"
    }
  ],
  "summary": "The practice of keeping credentials in a secret store, reading them at runtime and rotating them on a schedule.",
  "siblings": {
    "next": {
      "href": "https://banes-lab.com/ontology#architecture-privacy-by-design",
      "json": "https://banes-lab.com/json/records/architecture/privacy-by-design",
      "label": "Privacy by Design",
      "markdown": "https://banes-lab.com/records/architecture/privacy-by-design.md",
      "ref": "architecture:privacy-by-design"
    },
    "previous": {
      "href": "https://banes-lab.com/ontology#architecture-encryption-in-transit",
      "json": "https://banes-lab.com/json/records/architecture/encryption-in-transit",
      "label": "Encryption in Transit",
      "markdown": "https://banes-lab.com/records/architecture/encryption-in-transit.md",
      "ref": "architecture:encryption-in-transit"
    }
  },
  "up": {
    "href": null,
    "json": "https://banes-lab.com/json/api/records/architecture",
    "label": "Architecture principles",
    "markdown": "https://banes-lab.com/api/records/architecture.md",
    "ref": "api:records/architecture"
  },
  "aliases": [],
  "exemplar": {
    "after": "const apiKey = await secretStore.read(\"services/foo/api-key\");\nif (!apiKey) throw new Error(\"missing foo api key\");\nconst fooClient = new FooClient({ apiKey });",
    "before": "const fooClient = new FooClient({ apiKey: \"foo_live_abc123\" });",
    "lang": "ts",
    "medium": "code"
  },
  "formedBy": null,
  "scope": [
    "config",
    "deployment",
    "runtime"
  ],
  "severity": "mandatory"
}