Secrets Management

Kind: activity

Layer: Security Core

Record: architecture:secrets-management

Severity: mandatory

Scope: config, deployment, runtime

Canonical: Ontology

The practice of keeping credentials in a secret store, reading them at runtime and rotating them on a schedule.

Listed in Architecture principles, after Encryption in Transit and before Privacy by Design.

Requires

• Secret Store
• Rotation Policy

Reinforces

• Secure Configuration

Enables

• Safe Credential Handling

Conflicts with

• Hardcoded Secrets
• Secret Sprawl

In tension with

• Operational Complexity

Tensions

• Secrets Management / Operational Complexity

Contracts

• Secret Store Over Hardcoded Secrets

Violated by

• Secret Sprawl
• Hardcoded Secrets

Refactored by

• Secret Rotation

Severity

• mandatory

Category

• Security / Privacy / Compliance / Governance

Enforced by

• rules/eslint/no-secret-value.eslint.rule.ts
• runtime/entrypoints/credential.entrypoint.ts

Linked from

• The deploy is a file operation
• Anti-patterns
• Core Vocabulary
• Security Privacy Compliance
• Architectural Rules
• Severity levels
• The resolutions

in this codebase

• textOf
• portOf