Mastering Secrets Management

Passwords, API Keys, and SSH Keys are the keys to your kingdom. Storing them in Git (even in private repos) is a cardinal sin. You must use a dedicated Secrets Management system.

1. Centralized Storage

A Secrets Manager provides an encrypted, centralized location for all credentials. Access is strictly controlled via IAM policies. You can even enable Auto-Rotation, where the system changes the DB password every 30 days automatically without you lifting a finger.

2. Just-in-Time (JIT) Access

Advanced tools like **HashiCorp Vault** allow for JIT credentials. If a developer needs to access a DB, the Vault creates a *temporary* user with a 1-hour expiration. This ensures that even if the developer's laptop is stolen, the credentials are already dead.

4. Interview Mastery

Q: "How does a container fetch a secret from Key Vault without a password?"

Architect Answer: "We use **Managed Identity**. The cloud platform assigns a secure identity to the VM or Pod. When the app asks for a secret, the platform 'Vouches' for the app's identity. No secret-to-get-a-secret is needed. This is the gold standard for secure cloud architecture."