Deliverables

The curriculum covers what an architect should know. This covers what an architect actually hands over: 55 artifacts, each with a worked example, a note on when it is worth producing, who reads it, and the ways it usually goes wrong. Filter by the artifact's type, the kind of engagement that calls for it, the stack or industry it is drawn against, or the audience it is written for.

Identify the deliverable → 42 diagrams, shown one at a time with the answer withheld. Nothing to submit.

1 of 55 deliverables shown.

flowchart TB
  hsm[("HSM / Key Service<br/><i>root of trust · FIPS 140-2 L3</i>")]
  cmk["Customer Master Key<br/><i>per environment · rotate 1y</i>"]
  dek["Data Encryption Keys<br/><i>per dataset · rotate 90d</i>"]

  hsm --> cmk -->|"wraps"| dek

  subgraph vault["Secret Store"]
    direction TB
    v1["Static secrets<br/><i>rotate 90d</i>"]
    v2["Dynamic credentials<br/><i>DB · TTL 1h</i>"]
    v3["PKI issuer<br/><i>mTLS certs · TTL 24h</i>"]
  end
  cmk -->|"encrypts vault at rest"| vault

  subgraph wl["Workloads"]
    direction TB
    w1["Service A<br/><i>workload identity</i>"]
    w2["Pipeline<br/><i>OIDC federation</i>"]
  end

  w1 -->|"attests identity — no stored secret"| vault
  w2 -->|"short-lived token — no stored secret"| vault
  vault -->|"lease · auto-renew · revocable"| w1
  dek -->|"envelope decrypt"| w1
  audit[("Audit log<br/><i>every issue and revoke</i>")]
  vault --> audit

Security View

Key & Secret Management Diagram

Where keys and secrets live, what wraps what, how workloads get them without a stored credential, and how rotation actually happens.

Secrets Management Design