Secret Management — cheat sheet
A one-page lookup for the concepts and tools used across this course. Grouped by task; the course pages
cover the why behind each one — this page is just the what.
Keeping secrets out of code
| Task |
Guidance |
| Before first commit of a file with secrets |
add it to .gitignore first |
| A secret was already committed |
it's compromised — rotate it; deletion alone doesn't undo history |
| Getting a secret into a container |
inject at runtime (env var, mounted file, store lookup) — never COPY/bake it into a layer |
| Checking a repo for accidentally committed secrets |
a credential-scanning tool (e.g. gitleaks, trufflehog) |
Secret stores
| Task |
Reach for |
| Multi-cloud / on-prem, need dynamic (short-lived) credentials |
HashiCorp Vault |
| AWS-native, need automatic rotation for a supported service (e.g. RDS) |
AWS Secrets Manager |
| AWS-native, budget-sensitive, rotation not required or self-built |
AWS SSM Parameter Store (SecureString) |
| Storing a static value with versioning |
Vault KV secrets engine |
| Generating a brand-new, auto-expiring credential per request |
Vault dynamic secrets |
Kubernetes & GitOps
| Task |
Reach for |
| Get a secret into a running pod |
Kubernetes Secret (env var or mounted file) |
| Check what a Secret actually protects |
encryption at rest + RBAC — not base64 alone |
| Decode a Secret's base64 value (to understand it's not encryption) |
echo <value> \| base64 -d |
| Keep the real value in an external store, synced into the cluster |
External Secrets Operator (ExternalSecret resource) |
| Commit an encrypted value inside a YAML/JSON/ENV file to git |
SOPS |
| Commit a Kubernetes-native encrypted Secret to git |
Sealed Secrets (kubeseal) |
Rotation & least privilege
| Task |
Guidance |
| Cap risk from an undetected leak |
rotate on a schedule, not only after a known incident |
| Scope a credential's access |
narrowest resource (not a wildcard) + narrowest action (read vs. write) + one identity per workload |
| Avoid rotation being a manual chore |
prefer short-lived, dynamically issued credentials (Vault dynamic secrets, cloud STS-issued temporary credentials) |
| After rotating a secret in the store |
confirm every consumer actually picked up the new value |
How this connects
Never-in-code (page 1) is the entry discipline; secret stores (page 2) are where the real value actually
lives once it's out of code; Kubernetes Secrets & GitOps (page 3) covers getting that value into a running
cluster without exposing it in a git repo; rotation & least privilege (page 4) covers keeping it safe over
time, after it's deployed.