Secrets management is the discipline of securely handling the sensitive configuration values that applications need to function — database passwords, API keys, TLS certificates, encryption keys, SSH keys, OAuth client secrets, and any other credential or secret that must not be exposed to unauthorised parties.
The problem with naive secrets handling
The most common approach to secrets management in enterprise applications is also the worst: hardcoded secrets in source code, or secrets stored in environment variables or configuration files that are checked into Git. GitHub alone scans billions of commits per year and regularly detects millions of exposed secrets — AWS access keys, database passwords, API tokens — committed by developers who did not realise the implications.
The second most common approach is slightly better but still dangerous: secrets stored in a central configuration management system (Ansible Vault, Chef Encrypted Data Bags, Kubernetes Secrets) with long-lived credentials that are rarely rotated.
Dynamic secrets: the correct model
The correct model for secrets management in a zero-trust environment is dynamic secrets: short-lived credentials generated on demand for each application session, specific to the requesting service, and automatically revoked when the session ends. A database credential issued dynamically exists for the duration of a connection and is then deleted — there is nothing to steal, nothing to rotate manually, and no blast radius if a credential leaks.
Vault (HashiCorp's secrets engine) implements this model: it integrates with databases, cloud IAM systems, certificate authorities, and SSH, and issues dynamic credentials with configurable TTLs. AravaliStack includes Vault as a platform component, pre-integrated with all platform services.
Secrets management and compliance
RBI's IT governance framework, SEBI's cybersecurity guidelines, and CERT-In's directions all reference the need for robust credential management. Periodic rotation of service account passwords, audit trails of credential access, and separation of duties in secrets management are common requirements. A centralised secrets management platform with dynamic credential issuance satisfies all of these simultaneously.