How do you manage application secrets such as database passwords and API keys in a cloud environment?
What the interviewer wants to hear
- Store secrets in a managed secret store like Secrets Manager, Key Vault or Secret Manager
- Access through workload identity, IAM roles or managed identities, not static keys
- Encrypt with KMS and audit every read
- Automatic rotation and short-lived or dynamic credentials
- Never in code, images, plain env files or Terraform state where avoidable
- Secret scanning in repositories and CI
Model answer
I keep secrets in a managed store such as AWS Secrets Manager, Azure Key Vault or Google Secret Manager, encrypted with KMS keys. Applications get access through their cloud identity, an IAM role, a managed identity or Kubernetes workload identity, so there is no bootstrap secret to protect. Access is least privilege per service and every read is logged in CloudTrail or the equivalent. I turn on automatic rotation for database credentials, and where possible use short-lived credentials instead, such as IAM database authentication or dynamic secrets. Secrets must never be committed to Git, baked into images or put in plain environment files, so I run secret scanning in repositories and CI. In Kubernetes I sync secrets with the External Secrets Operator or the CSI driver. I also avoid putting secrets into Terraform state where possible.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cloud Engineer questions
- Design a secure three-tier web application on AWS (or your preferred cloud). Walk through the network and services.
- How do you manage Terraform state and multiple environments (dev, staging, prod) safely?
- A team stores customer documents in an S3 bucket. How would you secure it?
- An instance in a private subnet cannot reach the internet to install packages. How do you troubleshoot it?
- How would you plan the migration of an on-premises application to the cloud?
- Describe how you would build a CI/CD pipeline for Terraform changes across dev, staging and production.
- A team wants to move a service onto your Kubernetes cluster. What do you check before calling it production ready?
- You are on call and p99 latency for a cloud API jumps from 200 ms to 3 seconds. Walk through how you investigate and handle it.
- Design a tagging and cost allocation strategy for a company running many teams on AWS.