Manage secrets in IaC — Key Vault, SOPS, sealed secrets, and keeping credentials out of state files.
Five passes over the same idea, each from a different angle. Do them in order, or jump to whichever you need.
Secrets in IaC require special handling. Approaches: Azure Key Vault references, HashiCorp Vault, SOPS encryption, Kubernetes sealed secrets, and external-secrets-operator. Keep secrets out of state files: use data sources, environment variables, or managed identities. Never commit secrets to version control.
Where this topic shows up outside its home domain:
