Design a Secret Management Service
HardSystem design · Security
Design a Vault-style service for storing API keys, database passwords, certificates, and other secrets used by ~200K workloads. Cover storing and reading secrets, issuing short-lived dynamic credentials, rotation and revocation, access control, and an audit trail. Out of scope: building the HSM itself, a general-purpose KMS for customer data, and PKI/CA internals beyond issuing certificates.
Requirements
- Encrypt secrets at rest and in transit
- Support fine-grained access control and short-lived credentials
- Record tamper-resistant audit logs and enable rotation