Secrets management: vaults, rotation and leak monitoring
You find and revoke secrets scattered across code, configuration and scripts; you centralise them with a vault, dynamic credentials and privileged account management, automate rotation and monitor for leaks.
Level 501 · 14 lessons · 12 practice labs
Lessons
The problem
- Secret sprawl: code, configuration, scripts, chat
- Scanning code repositories for secrets
- Revoking and cleaning secrets committed to history
- Short task: find the secrets in the sample repository and write a revocation plan
The vault
- A secrets vault: authentication, policy, audit log
- Dynamic and short-lived credentials
- Connecting applications to the vault
- Privileged account management: moving shared admin passwords into the vault
- Short task: move an application’s database password into the vault
Operating
- Regular rotation and automatic renewal
- Emergency access: break-glass accounts
- External leak monitoring and incident response
- Secrets management metrics
- Capstone: inventory a fictional organisation’s secrets, move them into a vault and automate rotation
Practice labs
- Find plaintext passwords in configuration files: Scan configuration and script files on the lab server, inventory those holding plaintext passwords and identify their owners.
- Scan a code repository for secrets: Scan Göktaşı Yazılım's lab repository with a secret scanner, weed out false positives and list real findings by severity.
- Revoke and purge a secret committed to history: Revoke an access key committed to repo history, issue a new one, purge the history and verify with a rescan that nothing remains.
- Move an application's database password into the vault: Move the database password from the lab app's configuration into the vault and verify the app reads it from there with no trace left in the file.
- Issue short-lived database credentials: Define a vault role that issues time-limited database users and prove the account is removed when it expires.
- Bring shared admin passwords into the vault: Move Lodoskaya Denizcilik's shared admin passwords from a spreadsheet into the vault, define access policy and usage logging, and retire the spreadsheet.
- Rotate an API key and verify the application: Renew the lab service's API key, revoke the old one and prove the application keeps running without interruption.
- Automate secret rotation: Set up regular database password renewal through the vault and verify the app picks up the new password across two cycles.
- Respond to an access token leaked outside: Revoke a leaked token caught by the lab monitoring feed, review its usage logs, roll out a new one and write the incident note.
- Audit break-glass accounts: Check the number, storage and usage alerting of the lab's emergency accounts and report the gaps.
- Calculate secrets management metrics: Calculate the share of secrets in the vault, their average age and rotation overdue counts from the lab inventory, and prepare a short dashboard.
- Inventory secrets, move them to the vault and automate rotation: Find the secrets in Mercanköşk Otelcilik's lab environment, move them to the vault, automate rotation for two of them and write the result report.
About this course
You find and revoke secrets scattered across code, configuration and scripts; you centralise them with a vault, dynamic credentials and privileged account management, automate rotation and monitor for leaks.
What you will learn
- The problem
- The vault
- Operating
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.