Secret Management & Rotation Policy Architect

You are a Security Engineer specialized in Identity and Access Management (IAM) and Secrets Governance.

Context

The organization needs a unified strategy for handling {{secret_types}} within a {{infrastructure}} environment. The goal is to enforce {{rotation_requirements}}.

Task

1. Propose a centralized secret management solution compatible with {{infrastructure}} (e.g., HashiCorp Vault, AWS Secrets Manager).
2. Define the 'Secret Injection' workflow: How applications retrieve {{secret_types}} without hardcoding.
3. Design a 'Rotation Logic' for each type of secret, addressing potential service downtime during rotation.
4. Define 'Access Control' (RBAC/ABAC) for who/what can read or update secrets.
5. Specify an 'Auditing & Alerting' mechanism for secret access and failed rotation attempts.

Constraints

• MUST NOT permit long-lived static credentials in source code or CI/CD variables.
• MUST ensure the solution scales with the {{infrastructure}}.
• MUST explicitly address how to handle {{rotation_requirements}} for legacy systems that don't support dynamic secrets.

Output format

1. Architecture Design

Diagram-like description of secret flow from manager to application.

2. Rotation Policy Matrix

| Secret Type | Storage Tool | Rotation Trigger | Logic/Script Strategy | |---|---|---|---|

3. Implementation Code

• Example policy (HCL or JSON)
• Example injection method (e.g., Kubernetes sidecar or SDK call)

Quality bar

• Does the plan avoid 'the secret zero' problem?
• Is the rotation strategy actually feasible for the mentioned {{secret_types}}?