Key & Secret Management Diagram

flowchart TB
  hsm[("HSM / Key Service<br/><i>root of trust · FIPS 140-2 L3</i>")]
  cmk["Customer Master Key<br/><i>per environment · rotate 1y</i>"]
  dek["Data Encryption Keys<br/><i>per dataset · rotate 90d</i>"]

  hsm --> cmk -->|"wraps"| dek

  subgraph vault["Secret Store"]
    direction TB
    v1["Static secrets<br/><i>rotate 90d</i>"]
    v2["Dynamic credentials<br/><i>DB · TTL 1h</i>"]
    v3["PKI issuer<br/><i>mTLS certs · TTL 24h</i>"]
  end
  cmk -->|"encrypts vault at rest"| vault

  subgraph wl["Workloads"]
    direction TB
    w1["Service A<br/><i>workload identity</i>"]
    w2["Pipeline<br/><i>OIDC federation</i>"]
  end

  w1 -->|"attests identity — no stored secret"| vault
  w2 -->|"short-lived token — no stored secret"| vault
  vault -->|"lease · auto-renew · revocable"| w1
  dek -->|"envelope decrypt"| w1
  audit[("Audit log<br/><i>every issue and revoke</i>")]
  vault --> audit

What it is

The key hierarchy and the path by which a workload obtains a credential. Two properties carry the whole design: envelope encryption, so rotating a master key does not mean re-encrypting the data, and no stored credentials, so a workload proves who it is and receives a short-lived lease instead of holding a long-lived secret.

When you produce it

At landing-zone time, before the first application stores its first connection string. Retrofitting is a long programme because every consumer must change.

Who reads it

Security engineering, who build it. Application teams, who need to know how to get a credential without putting one in a file. Auditors, who ask about rotation and will ask for evidence it happened.

What good looks like

• Rotation period on every key and secret class, and rotation is automated — a documented manual procedure is a procedure that will not run.
• Dynamic credentials with a TTL wherever the backend supports them.
• Workload identity or OIDC federation, so the pipeline holds no long-lived cloud key.
• Envelope encryption drawn, with the wrapping relationships explicit.
• Break-glass path exists, is separately controlled, and its use alerts.

Common mistakes

• A secret store that services authenticate to with a stored secret. The bootstrap problem has to be solved with attestation or federation.
• Rotation policies nobody has exercised. Rotate once, deliberately, before the audit.
• One key for everything, so blast radius is total and rotation is impossible.
• Secrets in CI variables and images, which the diagram should explicitly exclude and the pipeline should scan for.