Cloudhard

Secrets vs config — where should you store secrets in a cloud setup?

Answer

Store secrets in a secret manager (or encrypted KMS-backed store) and inject them at runtime (env/volume), not in git or plain config files. Rotate secrets and follow least privilege.

Advanced answer

Deep dive

**Config** is non-sensitive (feature flags, timeouts, endpoints). **Secrets** are sensitive credentials (API keys, DB passwords, signing keys). The goal is to prevent accidental exposure and enable controlled rotation.

Recommended approach

Store secrets in a managed secret system (cloud Secret Manager / Vault) backed by encryption (KMS).
Grant access via identity (IAM role/service account), not by hardcoding keys.
Inject secrets at runtime (env vars or mounted files) and keep them out of:
git repos,
container images,
build logs and CI output.

Operational practices

Rotate secrets regularly and on incidents.
Use least privilege (separate credentials per service/environment).
Prefer short-lived credentials when possible (STS, workload identity).

Answer

Advanced answer

Deep dive

Recommended approach

Operational practices

Related questions