Secret Rotation Implementation Workflow
Implement a secret rotation process that regularly changes API keys and database credentials without downtime.
Objective
Establish a process for regularly rotating secrets without service disruption.
Environment
- A secrets manager
- Application with secrets loaded at runtime
- Dual-secret support for zero-downtime rotation
Steps
1. Inventory secrets
List all secrets used by the application and their rotation requirements.
Expected state: A complete inventory of secrets is created.
2. Enable dual secrets
Update the application to support both old and new secrets simultaneously.
Expected state: The application can authenticate with either the old or new secret.
3. Create new secrets
Generate new secret values and store them in the secrets manager alongside the old ones.
Expected state: New secrets are available in the secrets manager.
4. Deploy with new secrets
Deploy the application with the new secrets active and old secrets as fallback.
Expected state: The application uses new secrets with old ones as fallback.
5. Remove old secrets
After confirming the new secrets work, remove the old secrets from the manager.
Expected state: Old secrets are revoked and removed.
Decision points
How often to rotate?
- Every 90 days for critical secrets
- Every 365 days for less sensitive
Rotate critical secrets every 90 days; less sensitive secrets can rotate annually.
Expected outcome
All secrets are rotated without downtime, and the rotation process is documented for future use.
Verification
Verify the application works correctly after rotation; confirm old secrets are no longer valid.
Cleanup
Keep old secrets until the new ones are confirmed working; revoke them only after verification.
Rotation limits blast radius
Regular rotation ensures that leaked secrets have a limited useful lifetime. Dual-secret support makes rotation a zero-downtime operation.
Implementation Notes
This workflow provides a structured approach to ensure consistent results across team members and environments.
Common Pitfalls
Skipping verification steps or rushing through the process can lead to incomplete results. Always follow each step in order and verify before proceeding.
Quick Reference
# Execute the workflow steps as documented above
echo "Workflow completed successfully"