Credential rotation

As explained in Effective Platform Engineering

Credential rotation is the practice of replacing authentication credentials periodically or in response to security or lifecycle requirements.

Credential rotation replaces a service account’s access key and secret without interrupting the pipelines that use them. A practical pattern keeps two credentials valid while storing only the newest in the secrets store. An already-running job can then finish with the previous credential. section 6.4.4

Figure 6.19 Our service account has two valid credentials at any given time. Only the latest credential is maintained in the secrets store, and the prior keys remain valid until the next rotation to prevent workloads and orchestration from failing due to the race condition of the key being changed while a job is already in process.

The two-key overlap prevents a job from failing when rotation occurs after it has obtained the previous key. section 6.4.4

For infrastructure pipelines, rotation can run as a scheduled job alongside recurring integration tests. Separate nonproduction and production service accounts limit where each pipeline identity can assume roles. OIDC integration is another option, but establishing its trust still involves an identifying credential that may be difficult to rotate. section 6.4.4

How Effective Platform Engineering covers it

How deep it goes

Explains the two-valid-key pattern and shows scheduled rotation jobs, without detailing the rotation command’s internals.

Examples

Shows a credential-rotation command, a post-apply rotation step, and a weekly pipeline schedule.

What it assumes

Assumes familiarity with infrastructure pipelines and service accounts; introduces the two-key overlap through its operational purpose.

What you can do after

Operate/configure it as a scheduled pipeline job with overlapping service account credentials.

How it connects

Connects credential rotation to service accounts, secrets stores, integration tests, IAM roles, and OIDC trust.

liveBookmanning.com

Read Effective Platform Engineering on liveBook Get the book at manning.com

Related concepts

• password authenticationuses · Password authentication is an authentication method that verifies a claimed identity or access by checking a supplied secret password or passphrase.
• credentialuses · A credential is information or an artifact presented as evidence of an entity’s identity, qualifications, status, or authorization to access a system or resource.
• two-key credential rotationaddressed by · Two-key credential rotation is a rotation pattern that maintains two simultaneously available credentials so one can remain valid while the other is replaced.
• group managed service accountimplemented by · A group managed service account is an Active Directory service identity whose password is automatically managed and usable by services on authorized computers.

This explainer was generated by Manning's knowledge graph from the text of Effective Platform Engineering. The section links point to the parts of the book it draws on.