Secrets Management - Falling into the Pit of Success
summary
A large acquired SaaS shows the scale: ~1,200-line configs with ~25% secrets across 16 prod, 10 staging and 20+ dev environments, 40 teams and 350 developers, taking four months to inventory, five weeks for a first rotation and 640 dev hours to rotate production, then 20 months to centralize. The practical fix combines Infrastructure-as-Code and a composable secret+config model (demoed as ESC (Environment, Secrets and Config)) that uses OIDC trust and AWS credentials projection, acting as a proxy to Vault, Akeyless, CyberArk, Doppler or cloud secret stores to reduce developer friction while migrations remain time consuming.
AI-written summary · about
chapters (14)
- 0:00Secrets management struggles
- 1:06Secrets management is human
- 3:36Devs break security rules
- 5:00Secret rotation horror story
- 8:37Static secrets and poor rotation
- 10:25Secrets and config sprawl
- 14:03Need for secrets inventory
- 15:50Static to dynamic secrets
- 17:18Secret Zero and auditing
- 18:42Dev experience in secret tools
- 20:58Secrets and config as one
- 22:47Demo: Pulumi ESC for secrets
- 33:42Key takeaways
- 34:26Q&A on certificates
related talks
22mA Journey to Improving SLOs With Vault
38mKeeping Secrets - A Practical Approach to Managing Credentials
38mAdventures in Cloud Security: What DevOps Can Learn from a Security Engineer
24mDeveloper-First Application Security and DevSecOps
30mLong Live Short Lived Credentials - Auto-rotating Secrets At Scale
46mSecrets Management for the Modern Tech. Pro
30mSimplifying Secrets Management in the Public Cloud
29m100,000 Different Ways to Manage Secrets in GitOps