Comparison
Secret managementvsShort-lived credential
Secret management
the database password is fetched at start-up from a service that logs who asked, instead of sitting in the repository.
Storing credentials in a dedicated system with access control, audit and rotation, and delivering them to workloads at run time. The delivery mechanism matters as much as the store: an environment variable is visible to anything that can read the process, and a mounted file at least can be refreshed in place. The hard part is never the storage — it is that the workload must authenticate to the secret store somehow, which is what workload identity exists to solve.
Full entry →Short-lived credential
the token the workload holds expires in fifteen minutes, so a leaked one is worth almost nothing by the time it is found.
Credentials issued on demand with a short lifetime and renewed continuously, rather than static secrets that live until someone rotates them. It converts the security question from 'has this leaked' to 'how long is the window', and it removes rotation as a scheduled human task. It requires an identity the issuer trusts, which is why it and workload identity always arrive together.
Full entry →