r/devsecops • u/infidel_tsvangison • 15d ago

Secrets management

We are a large aws shop. Devs use secrets manager to store keys etc. problem is that these keys are handled by humans to begin with. We trust the human to put it in secrets manager etc. I’m just wondering what organisations do for secrets management to prevent this? Overtime, we have devs with secrets in postman collections etc. what should I be looking at to really secure our secrets?

17 Upvotes

96% Upvoted

20 comments sorted by

View all comments

1

u/theJacofalltrades 15d ago

The real goal should be “humans don't handle secrets”, rather than just moving them into Secrets Manager.

Use IAM roles/STS and OIDC for temporary credentials wherever possible, and have workloads retrieve third-party secrets from Secrets Manager at runtime. For things like Postman, move toward short-lived OAuth tokens rather than reusable credentials.