Secrets management (Vault, AWS Secrets Manager) in Microservices - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main purpose of secrets management in cloud applications?

Secrets management securely stores and controls access to sensitive information like passwords, API keys, and certificates to prevent unauthorized access.

intermediate

How does HashiCorp Vault help in managing secrets?

Vault centralizes secret storage, encrypts secrets, controls access with policies, and can dynamically generate secrets to reduce risk.

intermediate

What is a key feature of AWS Secrets Manager?

AWS Secrets Manager automatically rotates secrets, securely stores them, and integrates with AWS services for easy access and management.

beginner

Why should secrets never be hardcoded in application code?

Hardcoding secrets risks exposure if code is shared or leaked, making it easier for attackers to access sensitive data.

advanced

What is dynamic secret generation and why is it useful?

Dynamic secret generation creates secrets on demand with limited lifetime, reducing the chance of long-term secret exposure.

Which of the following is NOT a benefit of using a secrets manager?

A Centralized secret storage

B Access control policies

C Automatic secret rotation

D Hardcoding secrets in source code

Hardcoding secrets in source code is a security risk and not a benefit of secrets managers.

What does AWS Secrets Manager do to help keep secrets secure?

A Shares secrets publicly

B Encrypts secrets and rotates them automatically

C Requires manual secret updates only

D Stores secrets in plain text

AWS Secrets Manager encrypts secrets and can automatically rotate them to improve security.

In Vault, what controls who can access which secrets?

A Access control policies

B User passwords stored in code

C Open public access

D No controls needed

Vault uses access control policies to restrict secret access to authorized users or services.

Why is dynamic secret generation safer than static secrets?

A Secrets are stored in plain text

B Secrets never change

C Secrets expire after a short time reducing risk

D Secrets are shared with everyone

Dynamic secrets expire quickly, limiting the window for misuse if compromised.

Which service is best suited for managing secrets in AWS cloud?

A AWS Secrets Manager

B AWS S3

C AWS EC2

D AWS Lambda

AWS Secrets Manager is designed specifically for secure secret storage and management.

Explain how Vault manages secrets securely in a microservices environment.

Think about how Vault controls who can see secrets and how it limits secret lifetime.

Describe the benefits of using AWS Secrets Manager over hardcoding secrets in your application.

Focus on automation, security, and ease of use.