Rotation habits that stick

Dual-run windows and owners, not calendars alone.

In short. Rotation is the practice of replacing a credential before — or immediately after — its usefulness to an attacker.

Rotation is the practice of replacing a credential before — or immediately after — its usefulness to an attacker. Calendars alone fail: a password rotated in the store but cached in an app pool for seven days is not rotated. Dual-run (two valid credentials overlapping) is how grown-up systems rotate without downtime.

Own rotation like an on-call duty. Every secret needs an owner, a maximum age, a delivery path that can pick up new values, and a tested revoke step. If any of those are missing, you have a sticky note, not a control.

Dual-run pattern

Issue credential B while A still works. Deploy consumers to accept both (or to read the new value). Wait longer than the maximum cache/TTL. Disable A. This applies to API keys with two slots, database users with overlapping grants, and cloud access keys (create second key, switch, delete first).

# AWS access key dual-run sketch
aws iam create-access-key --user-name ci-bot
# update CI to new key, verify pipelines
aws iam delete-access-key --user-name ci-bot --access-key-id AKIA_OLD_EXAMPLE

{
  "AccessKey": { "AccessKeyId": "AKIA_NEW_…", "Status": "Active" }
}
# SUCCESS — old key deleted only after verification

Owners and evidence

Track secrets in a simple inventory: name, owner, location, last rotated, next due. Automation beats spreadsheets, but a spreadsheet beats folklore. After rotation, keep evidence (ticket, pipeline run) for audits. Prefer systems that rotate themselves (Vault dynamic secrets, managed rotation lambdas) over human calendar reminders.

Going deeper

Certificate rotation is the same dual-run idea: issue a new cert, reload listeners that accept both during overlap, then revoke or let the old expire. Short-lived certs from Vault PKI shrink the need for emergency revocations.

Human passwords and SSO reduce some rotation toil — prefer SSO over local passwords for humans. For machine secrets, prefer issuance over rotation: mint short-lived, let expiry be the rotation.

Track failed rotations as incidents. A job that "rotated" but left apps on the old key teaches everyone to ignore automation. Canary reads after every rotate.

Write the overlap window into the runbook as a number derived from measured cache TTLs, not a guess. If CDN edge caches config for thirty minutes, your dual-run must exceed thirty minutes plus deploy time plus a safety margin.

Try this

Pick one non-prod API key with two-slot support (or two DB users) and practice dual-run end-to-end, timing how long caches keep the old value.

printf '1) create new key\n2) deploy\n3) sleep > cache TTL\n4) revoke old\n' && date

1) create new key
2) deploy
3) sleep > cache TTL
4) revoke old
Fri Jul 24 21:00:00 IST 2026

Takeaway

Rotation works when consumers move, overlap is long enough, and old credentials die on purpose. Prefer automated short-lived credentials over annual password festivals.

Next: choose a manager — Vault, cloud-native, or encrypted git — with a clear decision tree.

Related