The ‘nth+1’ secret is now labeled as the ‘current’ secret, and the ‘nth’ secret is now labeled as previous.

Assuming the test passed, we can proceed to shuffle the secrets around.

Usually the system would perform a test now to ensure the new secret works, before it removes any existing secrets.If this works, currently three different passwords should work to access the system. where it needs to be set as a new password. The pending secret is transferred to the other system, e.g.This results in the creation of the ‘n+1’ value. At some point, a rotation is initiated.Any requests for a secret will return the current value, but any requests that are sent using the previous secret should (in the best case) still work. These are typically marked with a label, denoting one as the ‘current’ (most recently generated) secret, and the other as ‘previous’. Initially we start with two valid secrets, the ‘nth-1’ value and the ‘nth’ value.When a rotation is performed, we generate a new secret and deprecated the oldest version. Secret rotation essentially works by keeping two values of a secret valid at any time. So why have metaphorical humans running around with slips of metaphorical paper with magic words on them?Ĭan’t we cut out the middle-man? Let’s learn how understanding secret rotation can help us. The only actors that need to know the secret is service A and service B. Why all this manual handling in the first place?įundamentally, I don’t even care what the secret is - I don’t need to know and neither does anyone else. I’ve seen configuration files get ‘lost’ resulting in complete chaos to bring the services back up, because it wasn’t clear where the secrets were being sourced from. The last thing you should want to do is try to work out how to rotate a secret after it has been compromised.

Avoid it and you will find you will struggle to do perform it when it really counts. Secrets management is a chore and often ignored out of benign neglect. There are lot of things wrong with this.Ĭhaos ensues if the secret ever needs to change Unfortunately, I’ve seen a lot instances of hardcoding credentials between both services. A good deal of the time, this is to allow Service A to access Service B. A constant frustration of mine is sharing secret material between two services.

Aws secret manager rotation