DevOps, SRE & Cloud Interview · Networking, Security & LLMOps · Lesson 2 of 3
Secrets & platform security
Secrets — API keys, DB passwords, tokens — are the crown jewels. How you store, deliver, and rotate them separates a secure platform from a breach waiting to happen.
- Never hardcode secrets in code, images, or Git. Use a secret manager (Vault, AWS Secrets Manager, cloud KMS) and inject at runtime.
- Least privilege + short-lived: prefer dynamic, time-boxed credentials and per-workload IAM roles over shared long-lived keys.
- Encrypt in transit and at rest; rotate regularly and on any suspected exposure; audit every access.
- Defense in depth: network segmentation, image scanning, and a supply-chain check (signed images, SBOM) so a single hole is not fatal.
Env vars and images leakBaking a secret into a Docker image or committing an .env file is a top cause of breaches — image layers and Git history are forever. Inject secrets at runtime from a manager, and scan repos/images for leaked credentials.
◆ Lock it in
- Never hardcode secrets; use a secret manager and inject at runtime.
- Prefer short-lived, least-privilege credentials; encrypt in transit and at rest; rotate and audit.
- Layer defenses: segmentation, image scanning, signed images/SBOM for supply-chain integrity.
Feynman drill — say it out loudExplain why baking a secret into a container image is dangerous and what you would do instead.
Step 1 rate your confidence · Step 2 pick your answer
What is the safest way to give a container a database password?
Step 1 — how sure are you?