Secrets Rotation
The practice of regularly changing credentials such as API keys, database passwords, and tokens to limit the window an exposed secret is useful. Dynamic secrets, issued short-lived and on demand, are the strongest form.
Rotation on a calendar is a weak control compared to rotation on an event, and both are weaker than not having a long-lived secret at all. The reason teams avoid rotating is unknown blast radius: nobody is certain what breaks. That uncertainty is itself the finding, and fixing it (ownership, references rather than copies, tested rotation) matters more than the interval you choose.
See also: secrets management, API key, service account, secrets vendors
Related on Start with Identity
- GlossaryNon-Human Identity (NHI)
Any identity that is not a person: service accounts, API keys, OAuth tokens, certificates, workloads, and AI agents. NHIs now outnumber human identities in most
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea
- GlossaryPAM
Privileged Access Management. Controls for accounts and credentials with elevated permissions. Includes credential vaulting, session brokering, session recordin
- Vendor1Password Secrets Automation
strong
- GuideAPI Key Rotation Automation Guide
A practical guide to automating API key rotation with zero downtime, covering rotation strategies, secrets management integration, dual-key patterns, monitoring
- VendorAWS Secrets Manager
strong