- 01Hierarchy of secret quality: workload identity (best — no secret to manage), short-lived dynamic secrets per request (good), vault-managed with <30-day rotation (acceptable), long-lived static in vault (risky), in source / env files / chat (unacceptable).
- 02The biggest single move is replacing static cloud-API credentials with workload identity (IRSA, GCP Workload Identity, Azure Managed Identity, SPIFFE in Kubernetes). For database creds, dynamic secret backends or rotation lambdas.
- 03What still requires a vault: third-party API keys without OIDC support, on-prem systems without an IdP, break-glass credentials. For these: short-lived issuance, MFA-bound checkout, full audit logging.
- 04Inventory every secret. Map each to a target tier. Move secrets up the hierarchy quarterly. The metric that matters is 'count of long-lived static secrets' trending toward zero.
A decade ago, the gold standard was a centralized secrets vault with short-lived secrets injected into runtime. Today, the gold standard is to issue no static secret at all — the workload's platform identity is enough.
The hierarchy of secret quality
- 01Best — workload identity (no secret to manage)
- 02Good — short-lived dynamic secret issued by a vault per request
- 03Acceptable — vault-managed secret with automated rotation under 30 days
- 04Risky — long-lived static secret in a vault
- 05Unacceptable — secret in source, in environment files, in chat history
Migrating up the hierarchy
Inventory every secret. Map each to a target tier. The biggest single move is replacing static cloud-API credentials with workload identity (IRSA, GCP Workload Identity, Azure Managed Identity, SPIFFE in Kubernetes). For database credentials, dynamic secret backends in HashiCorp Vault or AWS Secrets Manager rotation lambdas are the practical pattern.
What still requires a vault
Third-party API keys without OIDC support, on-prem systems without an identity provider, break-glass credentials. For these, vault with short-lived issuance, MFA-bound checkout, and full audit logging.