build-a-secret-rotation-workflow

# build-a-secret-rotation-workflow ## When to use - Use for passwords, tokens, keys, certificates, signing material, or machine identities. - Never store secret values in plans, logs, tickets, or source. ## Preconditions - Inventory issuer, consumers, privileges, storage, delivery, sessions, dependencies, owners, and revocation. ## Procedure 1. Assign a versioned secret identity and affected trust boundary. 2. Discover direct, transitive, offline, emergency, and dormant consumers. 3. Create new trust through authorized isolated generation. 4. Distribute least-privilege references and verify each consumer on the new version. 5. Handle dual trust only for a bounded recorded overlap. 6. Revoke old trust, reject it in tests, close sessions, and monitor residual use. 7. Preserve rollback without silently reactivating compromised material. ## Failure plan - Stop revocation when a critical unknown consumer appears, contain its privilege, and resolve ownership. ## Worked example A database credential rotates by workload cohort, with old-login rejection and session closure proven afterward. ## Done - A rotation workflow document records secret identity, consumers, generation, distribution, verification, revocation, rollback, and ownership - Unknown-consumer, overlap, session, stale-copy, least-privilege, old-secret-rejection, and recovery tests verify closure