Managing Secrets Without Losing Sleep

By Owen Gallagher · May 18, 2026 · Security

There are exactly two ages of secrets management: 'we keep them in an encrypted file' and 'we were audited'. The distance between them is covered by rotation policies, access trails, and the gradual realisation that humans should read production credentials roughly never.

Short-lived credentials issued by workload identity beat long-lived static keys in every dimension except convenience. The bootstrap problem - how does the workload prove itself - is solved differently on every platform, but the shape is identical: an identity document signed by the platform, exchanged for a token with a TTL measured in minutes.

Whatever you do, put rotation in the deploy pipeline rather than the runbook. A rotation procedure that requires a human to remember it will be discovered broken at the worst possible moment, which is also when you need it most.