# Secrets Management

> The practice of keeping credentials in a secret store, reading them at runtime and rotating them on a schedule.

Record: `architecture:secrets-management`
Kind: activity
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: config, deployment, runtime
Canonical: https://banes-lab.com/ontology#architecture-secrets-management

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Encryption in Transit](https://banes-lab.com/records/architecture/encryption-in-transit.md) and before [Privacy by Design](https://banes-lab.com/records/architecture/privacy-by-design.md).

## Repair

- Refactored by: Move to Secret Manager, Rotate Secret
- Detected by: secret scanning
- Violated by: secrets in code/config files/logs
- Measured by: secret exposure count
- Enforced by: secret scans, CI gates

## Requires

- [Secret Store](https://banes-lab.com/records/lexicon/secret-store.md)
- [Rotation Policy](https://banes-lab.com/records/lexicon/rotation-policy.md)

## Reinforces

- [Secure Configuration](https://banes-lab.com/records/lexicon/secure-configuration.md)

## Enables

- [Safe Credential Handling](https://banes-lab.com/records/lexicon/safe-credential-handling.md)

## Conflicts with

- [Hardcoded Secrets](https://banes-lab.com/records/lexicon/hardcoded-secrets.md)
- [Secret Sprawl](https://banes-lab.com/records/architecture/secret-sprawl.md)

## In tension with

- [Operational Complexity](https://banes-lab.com/records/lexicon/operational-complexity.md)

## Tensions

- [Secrets Management / Operational Complexity](https://banes-lab.com/records/tension/operational-complexity-secrets-management.md)

## Contracts

- [Secret Store Over Hardcoded Secrets](https://banes-lab.com/records/algorithms/no-hardcoded-secrets.md)

## Severity

- [mandatory](https://banes-lab.com/records/vocabulary/severity-mandatory.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Linked from

- [The deploy is a file operation](https://banes-lab.com/disciplined-methodology/ship/the-deploy-is-a-file-operation.md)
- [Anti-patterns](https://banes-lab.com/ontology/principles/architecture-category-anti-patterns.md)
- [Core Vocabulary](https://banes-lab.com/ontology/lexicon/lexicon-category-core-vocabulary.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Architectural Rules](https://banes-lab.com/ontology/algorithms/algorithms-domain-architectural-rules.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)