Secrets at Scale: Managing Cloud Credentials with PowerShell Automation
summary
Claims a better goal than rotation: eliminate secrets where possible. Shows PowerShell code that authenticates with certificates (non-exportable local store), federates GitHub Actions via OIDC to obtain short-lived tokens, and uses IAM Roles Anywhere plus STS to assume AWS roles. Demonstrates Azure Key Vault certificate policies with auto-rotation, AWS Secrets Manager rotation via Lambda, and patterns to inject credentials into CI/CD pipelines and audit usage so secrets disappear or expire just-in-time.
AI-written summary · about
chapters (12)
- 0:00Cloud credential management intro
- 1:55Problem with storing secrets
- 4:48Eliminating secrets principle
- 6:10Certificates for authentication
- 11:44OIDC for pipelines
- 17:00Just-in-time tokens
- 20:35Secure secret storage
- 22:48Key takeaways
- 29:12Q&A on vaults
- 39:51Preferred auth approaches
- 42:21Secret management solutions
- 43:22Closing thoughts
related talks
46mSecrets Management for the Modern Tech. Pro
55mHandling secrets in cloud-based applications
30mLong Live Short Lived Credentials - Auto-rotating Secrets At Scale
30mSimplifying Secrets Management in the Public Cloud
22mSecure your secrets with automation
26mThe Power of SecretOps Automating Secret Workflows
29mManaging Secrets in Your Cloud Environment
47mManaging your Secrets in a Cloud Environment