TLS, Secrets & Rotation

Transport security protects data in transit, while secret management secures credentials, API keys, and private keys at rest. Modern infrastructure enforces automated rotation to minimize the lifetime of compromised credentials.

Core details

Emergency Leak Response Playbook

If a secret is leaked to logs or GitHub:

1. Revoke and Rotate: Immediately invalidate the compromised credential and provision a new one.
2. Audit Exposure: Analyze access logs (CloudTrail, database audits) to trace any unauthorized requests using that key.
3. Clean History: Use tools like git-filter-repo or BFG Repo-Cleaner to scrub the commits if leaked in version control.
4. Notify Stakeholders: Escalate based on classification tier (PII exposure, database write access).

Understanding

TLS Termination Topology

In standard cloud architectures, TLS is decrypted at the edge (Load Balancer / Ingress Controller). Traffic within the VPC may continue in plaintext (HTTP) or use internal Mutual TLS (mTLS) via a service mesh (Linkerd, Istio).

• Edge Termination: Reduces CPU load on downstream application pods.
• End-to-End Encryption: Mandated by strict compliance frameworks (e.g., PCI-DSS).

Dynamic vs Static Secrets

Static secrets (stored in environment variables or .env files) never change. If a server is compromised, these keys remain valid forever. Dynamic secrets are generated on-the-fly by key vaults, bound to short Time-To-Live (TTL) durations, and automatically clean up after use.

Senior understanding

Accessing Secrets Safely (Go example)

Instead of loading static keys from local environment files, query a secrets manager dynamically using temporary IAM roles:

package main

import (
	"context"
	"log"

	"github.com/aws/aws-sdk-go-v2/config"
	"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
)

func GetDatabasePassword(secretName string) (string, error) {
	ctx := context.TODO()

	// 1. Initialize AWS SDK using local instance metadata credentials (IAM Role)
	cfg, err := config.LoadDefaultConfig(ctx)
	if err != nil {
		return "", err
	}

	client := secretsmanager.NewFromConfig(cfg)

	// 2. Fetch secret value dynamically
	input := &secretsmanager.GetSecretValueInput{
		SecretId: &secretName,
	}

	result, err := client.GetSecretValue(ctx, input)
	if err != nil {
		return "", err
	}

	return *result.SecretString, nil
}

Diagram

See also

• Identity: sessions vs bearer
• CSRF & session cookies
• SSRF & controlled outbound HTTP