Most teams agree credentials should be rotated and most do not rotate them, because the first attempt broke something at an inconvenient moment. The fix is not more resolve; it is designing the process so that rotation never requires a flag day.
The pattern that works
- Create a second credential alongside the first. Both are now valid.
- Deploy the new credential to consumers, one at a time.
- Watch usage metrics until the old credential shows no activity.
- Deactivate the old credential, but do not delete it yet.
- Wait a defined period, confirm nothing broke, then delete it.
The key property is that there is never a moment when no valid credential exists. Everything else – schedules, automation, tooling – is detail on top of that.
Know where credentials live before you start
Rotation breaks things when a consumer is forgotten. Before the first rotation, write down every place a given credential is used.
- Application configuration and environment variables.
- CI/CD pipeline secrets.
- Scheduled jobs and cron tasks.
- Infrastructure-as-code state and variable files.
- Developer machines and local tooling.
- Third-party services you have integrated.
Use a secret manager as the single source
If every consumer reads a credential from one place, rotation means updating one place. If credentials are pasted into six configuration files, rotation means finding all six under time pressure. A secret manager is the difference between a routine task and an incident.
| Location | Verdict |
|---|---|
| Secret manager | Yes – the intended home. |
| CI/CD secret store | Yes, ideally synced from the secret manager. |
| Environment variables injected at runtime | Acceptable. |
| Committed configuration files | No. |
| Chat messages and tickets | No. |
| Developer laptops, long-lived | Avoid; prefer short-lived credentials. |
Prefer credentials that expire on their own
Where the platform supports short-lived, automatically issued credentials – role assumption, workload identity federation, instance roles – use them instead of long-lived keys. A credential that expires in an hour cannot be leaked in a way that matters six months later, and it removes rotation from your list entirely.
Summary
Overlap, deploy, verify, deactivate, delete. Keep one source of truth for secrets, know every consumer, and prefer short-lived credentials wherever the platform offers them. Done this way, rotation stops being something the team dreads.
