1 min lesson
Secrets and rotation
Rebuild the main list in "Secrets and rotation", then say what each item changes.
Step 1 of 3
Secrets and rotationno standing credentials in plaintext
- Store secrets in AWS Secrets Manager or SSM Parameter Store, encrypted with KMS and pull them at runtime - not at build time.
- Mount into pods via the Secrets Store CSI driver or External Secrets, scoped per workload via IRSA, so a pod only ever sees its own secrets.
- Rotate on a schedule and after any suspected exposure; prefer credentials that are short-lived by construction over ones you remember to rotate.
Learn more
Full explanation
Containing blast radius by design
Containing blast radius by designboundaries, not just rules
The strongest containment is structural. Separate AWS accounts per environment mean a blown prod credential cannot touch staging and a misconfigured staging policy cannot reach prod data. Organization SCPs (Service Control Policies) sit above every role as a guardrail ceiling: even an over-broad role can't exceed what the SCP permits, so a mistake in one team's policy can't escalate past the account's hard limits.
Frame every IAM answer around the failure: "Assume this credential leaks. With IRSA the attacker gets one workload's narrow role; with separate accounts they can't cross into prod; with an SCP they can't disable logging or leave the region." Reasoning in blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. reads as senior; listing policy syntax reads as junior.