CyArt Academy
Unlock ProSign in
CYART // SCHEMA · SECRETS-MANAGER8 NODES · 7 LINKSIDENTITY1TOKEN2ALLOWED?3READ4UNWRAP DEKMINT SHORT-LIVEDACTOR · Workload — pod / lambda / VMACTOR01Workloadpod / lambda / VMEDGE · Auth methods — OIDC, IAM, k8s SAEDGE02Auth methodsOIDC, IAM, k8s SASERVICE · Secrets API — lease, TTL, auditSERVICE03Secrets APIlease, TTL, auditSERVICE · Policy engine — path ACL, deny by defaultSERVICE04Policy enginepath ACL, deny by defaultDATA · Encrypted store — Raft, envelope encryptionDATA05Encrypted storeRaft, envelope encryptionDATA · KMS / HSM — root key never exportedDATA06KMS / HSMroot key never exportedSTREAM · Dynamic backends — DB users, cloud credsSTREAM07Dynamic backendsDB users, cloud credsDATA · Audit log — append onlyDATA08Audit logappend only

Secrets management and rotation

Static secrets are the problem; short-lived credentials are the answer. Dynamic secrets, workload identity, rotation without downtime and what to do when a key leaks.

🔒 PROLesson·24 min read·Intermediate → Advanced
secretsKMSrotationworkload identity

01From static to dynamic

✓What you will learn
  • Replace static secrets with workload identity and dynamic credentials
  • Rotate without downtime using dual-key windows
  • Run a leak response in under an hour
FigA secrets manager that mints rather than stores
CYART // SCHEMA · SECRETS-MANAGER8 NODES · 7 LINKSIDENTITY1TOKEN2ALLOWED?3READ4UNWRAP DEKMINT SHORT-LIVEDACTOR · Workload — pod / lambda / VMACTOR01Workloadpod / lambda / VMEDGE · Auth methods — OIDC, IAM, k8s SAEDGE02Auth methodsOIDC, IAM, k8s SASERVICE · Secrets API — lease, TTL, auditSERVICE03Secrets APIlease, TTL, auditSERVICE · Policy engine — path ACL, deny by defaultSERVICE04Policy enginepath ACL, deny by defaultDATA · Encrypted store — Raft, envelope encryptionDATA05Encrypted storeRaft, envelope encryptionDATA · KMS / HSM — root key never exportedDATA06KMS / HSMroot key never exportedSTREAM · Dynamic backends — DB users, cloud credsSTREAM07Dynamic backendsDB users, cloud credsDATA · Audit log — append onlyDATA08Audit logappend only
  • ACTOR
  • EDGE
  • SERVICE
  • DATA
  • STREAM
  • Live flow
  • Lookup / async
//Workloads prove identity (cloud IAM, Kubernetes service account, OIDC). The API checks policy, reads from an encrypted store whose keys are wrapped by KMS, or mints short-lived credentials directly from a backend (database user for 1 hour, cloud role for 15 minutes). Everything is leased and audited.
  • Workload identity first: if the platform can prove who the workload is, you do not need a secret to fetch secrets.
  • Dynamic over static: a database credential that expires in an hour is worth little when leaked.
  • Lease and renew: clients renew before expiry; revocation cuts off every lease from a compromised identity.

This is an advanced module

Identity & Access Engineering is part of the Pro pass. 1 more section — the deep dives, the final design, follow-ups and the test — unlock with it.

Enter access codeSee Pro pass

Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.