Key Points for Managing Secrets Using Secret Management Products

• Rotation/Temporality: Ensure that the credentials used to authenticate with the secrets management system are rotated frequently and expire after their intended use.
• Scope of Authorization: Limit the scope of credentials to only those secrets and services necessary for their intended function.
• Attribution of the Caller: Maintain the ability to attribute actions to the individual or service that made requests to the secrets management solution. If this isn’t supported by default, implement a correlation mechanism to track requests.
• Compliance: Adhere to the best practices listed in Best Practices for Key Management, including logging, alerting, and other essential measures.
• Backup: Store backups of critical secrets, such as encryption keys, in separate, secure storage solutions (e.g., cold storage).