Secret Management Best Practices

In this section, we'll go through some secret management best practices. These points are essential to understand in order to manage secrets in a DevOps environment. The following figure shows secret management best practices, which are valuable practices for securing sensitive information:

Figure 6.8: Secret management best practices

Identifying Secrets

The very first step for secret management is to identify all kinds of secrets. They include, but are not limited to, passwords, SSH keys, and certificates for communication (for example, TLS). It is very important that this should be a continuous process. That is, all new configuration values should be evaluated and treated as secret if they include any sensitive information. Also, secrets should be constrained to have enough complexity to make them difficult to solve. For example, when you integrate your application with another one, you'd usually need a kind...