Software ArchitectureAtlas

Software Architecture Atlas

Gain an overview. Understand the connections.

ConceptChapter III · Security · Building block 5 of 7

Secrets

Secrets are confidential access data such as keys, tokens and passwords. A secure life cycle restricts storage and access and makes renewal and blocking plannable.

By Michael Meierhoff · Meierhoff Systems

  1. OverlappingBriefly, both keys valid.
  2. SwitchoverPayment module switches to the new key.
  3. WithdrawalOld key is blocked.

Context

Why this is important

An access token in the source code or without a schedule remains permanently usable after a leak. A regulated life cycle makes renewal and blocking routine. What rights a secret carries is governed by Least Privilege.

This building block covers runtime secrets. Least Privilege limits the rights of a secret; authentication uses it for identity verification.

At a glance · Secrets to Getting Runtime

The service fetches access data from the Secret Store at startup; there is none in the code and repository.
Shop example · Playing through stages

Rotation of the provider token

The shop uses a provider access token for payment requests. A central runtime service provides it to the payment module and supports the change to a new key.

This is how you read the picture

  1. Overlapping Step 'Both valid': 'Valid keys' shows 2 (old and new).
  2. Switchover Step 'Payment module switched': 'Payment queries' run with the new key.
  3. Withdrawal Step 'Old blocked': 'Valid keys' shows 1 (new).
  • 1 (old)Valid keys
  • run with old keyPayment queries

The new key is created in runtime memory; the old one stays in operation.

Go through the rotation step by step and switch off the overlap to see the error.

Benefits & limitations

Helps if:

  • Confidential credentials need controlled use and access across all environments.
  • Leaks, staff changes and renewal benefit from a traceable rotation and revocation process.

Boundaries

  • Rotation without an overview of all consumers can cause outages; first confirm the update, then revoke the old token.
  • Even authorised processes should read only the values they need; Least Privilege governs this.
  • An already leaked secret remains usable until revocation; access logs detect abuse, but do not replace rotation.

In practice

  1. Inventory secrets and consumers. Record each value’s type, owner, environment, consumers and expiry or renewal rule. Separate test and production access. This produces a verifiable inventory with known dependencies.
  2. Limit access and delivery. Bind retrieval to a verified workload or user identity and expose only required values at runtime. Keep them out of source code, logs and unprotected artefacts. This controls access and disclosure.
  3. Rehearse rotation and emergency handling. Plan creation, the transition window, confirmation and revocation of the old value. Define how to handle a suspected leak, including searches of relevant stores. This establishes a verifiable replacement and revocation process.
Read the detailed explanation

Secrets are confidential values that identities or services use for protected access. Their lifecycle covers creation, storage, delivery, use, rotation and revocation. A central store and workload identity control access; Least Privilege limits permitted recipients, while Authentication & Authorisation links retrieval to a verified identity.

Encrypted storage protects against unauthorised access to stored data, but not against a compromised process with legitimate read access. Rotation requires coordinated updates to all consumers and confirmation that the new value is in use before revoking the old one. Logging, filtering and emergency procedures complete the safeguards. Short-lived credentials limit the window for misuse. Protection also depends on delivery, runtime permissions and logging. Storage and encryption are parts of a controlled lifecycle.

Check your understanding

Test yourself in three stages

  1. ReadingCheck in the picture

    How many valid keys does the step 'Both valid' show?

    View the solution with justification

    Two: the old and the new key.

  2. ApplyingTransferred to a new situation

    The old key is blocked before the payment module is switched. What happens?

    View the solution with justification

    Payment queries fail, because the payment module still uses the blocked key until the switch takes place.

  3. EvaluateWeighing an alternative

    The team wants to keep the old key valid for a long time after the switch. What speaks for it, what speaks against it, and what do you recommend?

    View the solution with justification

    Advantage: a convenient way back. Disadvantage: a leaked old key remains usable for longer. Recommendation: a short, tested time window, then revocation.

Explore further

These building blocks continue the thoughts of this page.

SecurityLeast PrivilegeLeast Privilege limits access to the permissions a task actually needs.Opening SecurityAuthentication & authorisationAuthentication establishes identity; authorization checks whether an action is permitted.Opening OperationsDeployment & rolloutDeployment and rollout distribute software changes to the runtime environment under control.Opening

References

Continue on the learning path

Next in Security & risks: Shared Database.

7 Building blocks

Continue withShared Database