Explain like I'm five · Security

What is Secrets Management?

Secrets management, told as a story about a storeroom key the builder nailed to the plan, and the locked box it moves into.

STOREHOUSE TOWER PLAN1. lay the bricks2. open the storeroom →3. put the goods intoo much bother to fetch it every timenailing the storeroom key to the plan is convenient, sure

The builder nailed the key to the plan, to save himself the trip.The builder hated fetching the key every time he opened the storeroom. So he nailed it to the plan. Convenient, sure.

the villagePLANdrew one copyPLANPLANPLANthe thief has a key tooplans get copied around — and the key goes with them

Plans get copied and go out to the village. The key goes with them.Plans are meant to be copied around. Copy one with the key still on it, and the whole village has a storeroom key.

STOREHOUSE TOWER PLAN1. lay the bricks2. key box, slot 33. put the goods inthe plan names the slot, not the key123the locked key boxthe guard opens itthe key lives in the box — the plan just says slot 3the plan can travel — the key stays home

Secrets management is never nailing the key to the wall.The key goes in a locked box. The plan just says key box, slot 3. Borrow it from the guard when needed, and change it often.

In a locked boxthe box, not the plan
Borrow brieflygive it back when done
Change it oftena stolen one soon fails
Just the slot numberthe plan says slot 3, nothing more
last month's keythis month's keythe stolen key does not fitmonthlyborrow it briefly, give it backchange the key often, and a stolen one soon opens nothing

Change the key often, and a stolen one soon opens nothing.The key is replaced every month. The builder borrows it briefly and returns it. So a thief holding last month's key opens nothing.

NEW PLAN1. lay the bricks2. back door key →a key is nailed to the plan! move it to the boxa nailed key sets off the bellevery time a brick is laid, automatically

The guard always checks the plan for nailed keys.People will nail keys again. So the plan check rings the bell whenever it spots a key shape — every time a brick is laid, automatically.

In one breath

Secrets management = keep the key in a locked box instead of nailed to the plan, borrow it briefly, change it often, and write only the slot number on the plan.

Secrets Management. Passwords, API keys, tokens, and certificates are kept in a vault instead of hardcoded. Code references them by name, receives them briefly at runtime, and they are rotated on a schedule.

When grown-ups say it

Secret
The storeroom key. Passwords, tickets, the key to a sealed letter. Leak it and the door opens. → a ticket instead of a key
Hardcoding
Nailing it to the plan. Writing the key into the code as text. Convenient, but it goes wherever the code goes.
Vault
The locked key box. All keys locked in one place, with a log of who took which one when. → the master key in the vault
Rotation
A new key every month. Change the key on a schedule. A stolen key expires fast.
Environment variable
The key slipped into your pocket for the shift. Not on the plan (code); handed over only when the job starts. Weaker than the box, but far better than a nail.
Secret scanning
Spotting key shapes on the plan. Automatically finds strings shaped like keys and rings the bell. → reading the drawing and knocking on the wall
API key / token
The shop ticket. A key that opens one shop only. Still a key — keep it in the box. → a ticket instead of a key
Least privilege
Only the key to that one door. The storeroom key must not open the vault too. → a key ring for every hat
Next story
Reading the Drawing, Knocking on the Wall →
Want another term as a picture book? Request →