5.2 Secrets, keys and encryption
No credential of yours lives in a repository, an environment variable dump or a screenshot.
Before:04. Networking in the CloudUnlocks:06. Containers & Kubernetes
The same thing, three names
One idea, sold under a different brand by each provider. Learn it once and you can read any job advertisement.
- On AWS
- KMS + Secrets Manager
- On Azure
- Key Vault
- On Google Cloud
- Cloud KMS + Secret Manager
No credential should live in a repository, an environment dump or a screenshot, and this topic builds the alternative: managed key services, envelope encryption, rotation, and secret stores that inject values at runtime. Encryption at rest and in transit are covered by what each actually protects against, which is less than either phrase suggests alone. It sits second in the security module because identity says who may act and secrets are what leak when that fails. The hour-one drill matters most: knowing, before a key leaks, exactly what you would do in the hour after.
Work through these
Encryption at rest and in transit, and what each protects against
Encryption at rest protects data on a stolen or decommissioned disk; encryption in transit protects it from someone watching the network. They defend against different attackers and you need both.
Managed key services, key rotation and envelope encryption
A managed key service holds the keys, rotates them on a schedule, and encrypts your data keys with a master key it never releases. That last arrangement is what envelope encryption means.
Secret stores and injection at runtime
A secret store hands credentials to an application at run time so they never appear in a repository or an image. Injection at run time is the whole point of the arrangement.
What to do the hour a key leaks
A leaked key is an emergency with a fixed procedure: revoke it, rotate what it protected, then read the logs for what it was used for. Deciding that order beforehand is why this item exists.
Sign in to keep your progress.
Free resources
We haven't checked most of these for screen reader use yet.
Links last checked 29 Aug 2026.
Stuck here?
Ask a mentor. A real person answers, and they can see exactly which topic you're on. Usually within a couple of working days.
Checking your session…
Topics shown in module order.