Secrets for Machines
Applications need credentials too. Static secrets in configuration are the largest remaining category, and dynamic issuance is the way out.
Analysis
Human privileged access has a mature toolset. Machine credentials are a larger population growing faster, with weaker controls.
What counts
Database connection strings.
API keys for internal and external services.
Cloud access keys.
Certificates and private keys.
Encryption keys.
Pipeline credentials, which frequently have the broadest access of all.
Container and orchestration secrets.
Where they live now
In configuration files on servers.
In source control, which is the most damaging case and the most common.
In pipeline variables, which are better and still static.
In container images, baked in at build time.
In environment variables, visible to anything running on the host.
In documentation and tickets, pasted for convenience.
In developers' local files, copied from production years ago.
The source control problem
Worth separating because it needs urgent action.
A secret committed to source control is exposed to everyone with repository access, forever, including in history.
Removing the file does not remove it from history.
Rotation is the only remedy. Not deletion, not history rewriting alone — the credential must be changed.
Scan repositories, including history, and scan on every commit going forward.
Treat every finding as a compromise, and rotate, because you cannot know who read it.
Dynamic secrets
The structural fix.
A secrets manager issues a credential on request, valid for a short period, tied to the requesting workload.
No static value exists to be leaked, committed or copied.
Revocation is automatic through expiry.
Every issuance is logged, giving attribution that static credentials never had.
Requires the target system to support it — databases and cloud platforms commonly do; older applications frequently do not.
Workload identity
Better still, where available.
The platform vouches for the workload and issues credentials with no secret to store at all.
Available in major cloud platforms and container orchestrators.
Removes the bootstrap problem — the question of how the application authenticates to the secrets manager in the first place, which otherwise requires one static secret.
The realistic sequence
Scan and find what exists, including in source history.
Rotate everything found in source control, treating it as compromised.
Move static secrets into a manager, which is an improvement even without dynamic issuance.
Enable scanning on commit so the problem stops growing.
Migrate to dynamic secrets where the target supports it, system by system.
Adopt workload identity for new workloads by default.
Expect the migration to take years and the scanning to start paying immediately.
What to measure
Secrets found in source control, which should trend to zero and be alerted on.
Proportion of workloads using dynamic or platform identity rather than static secrets.
Age of the oldest static secret in each tier.
Time to rotate a machine credential, measured by drill rather than assumed.
Scanning on commit
The control that stops the source control problem growing while the backlog is cleared.
Run detection on every commit, before it reaches the shared repository where possible.
Block rather than warn for high-confidence findings, with a documented override.
Scan history once for the existing backlog.
Tune the rules, because false positives train people to override reflexively.
Report the finding rate, which should fall as developers adapt.
Treat every true positive as a compromise and rotate, since you cannot know who read it.
The bootstrap problem
An application needs a credential to authenticate to the secrets manager, which is itself a secret.
Platform identity solves it, where available: the cloud or orchestration platform vouches for the workload and no stored secret exists.
Instance metadata and attestation serve the same purpose on some platforms.
Where neither exists, one static credential remains, and it should be the only one, with tight scope and monitoring.
Do not pretend it away. A design claiming zero static secrets while quietly holding a bootstrap token is less honest and no safer than one that names it.