Secrets Management Basics
How should services obtain database passwords and API keys in production (vs committing .env to git)?
Answers use simple, clear English.
Quick interview answer
Use a secrets manager (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) or platform-injected secrets (K8s Secrets with encryption at rest / external secrets operator). Rotate credentials, scope least privilege, audit access, and never log secret values. Short-lived credentials (IAM roles, workload identity) beat long-lived static keys.
Detailed answer
Use a secrets manager (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault) or platform-injected secrets (K8s Secrets with encryption at rest / external secrets operator). Rotate credentials, scope least privilege, audit access, and never log secret values. Short-lived credentials (IAM roles, workload identity) beat long-lived static keys. .env is fine for local only — not a production secret store.
Full explanation
.env is fine for local only — not a production secret store.
Real example & use case
EKS pod assumes an IRSA role to read RDS credentials from Secrets Manager at startup.
Pros & cons
Pros: rotation + audit. Cons: operational dependency — cache secrets carefully on manager outages.