A credential store is a centralized service for protecting application secrets such as passwords, API keys, digital certificates, and other sensitive values required at runtime. It replaces scattered configuration files with a controlled source of truth. section 2.2
Configuration files are difficult to secure and audit, create synchronization errors across machines, and make regular credential rotation cumbersome. A credential service centralizes updates and can notify applications when new values become available. section 2.2 section 2.3
A credential store provides:
- One source of truth that reduces configuration drift across application instances. section 2.2
- Credential metadata, including expiration information, to support selecting valid versions and simplifying rotation. section 2.2
- Fine-grained audit logs for monitoring suspicious activity and investigating incidents. section 2.2
- Hardware security module support for stronger protection of stored secrets. section 2.2
The unsafe configuration-file pattern
An application that hardcodes an HMAC key in source code or stores it in plain-text configuration exposes the key to anyone who obtains the code or configuration. Store the key in a secure credential store instead. section 4.7
Figure 2.9 A credential management service and an SSO service are two foundational components of cloud-native application security. As a developer, you can use the OIDC and WebAuthn protocols to interact with all modern SSO services. But for credential services, there is no industry-standard API, so you have to use a proprietary API provided by the credential service’s implementation.
Use this comparison to distinguish credential-management services from SSO services and to recognize that credential stores lack a universal industry-standard API. section 2.4
