Lion Cipher Lab
Store secrets the right way with a cloud secrets manager
- Cloud Security
- Beginner
- ~35 min
- Free · no account required
Why it matters
The api-keys lab got secrets out of your code and into environment variables and gitignored .env files — the right first step for local work. But once more than one person or machine needs a secret, or it's headed for production, plaintext files stop being good enough: they sit unencrypted, get copied around, and have no access log. A cloud secrets manager fixes that — it stores secrets encrypted, gates access with the same IAM policies that protect everything else, logs every read, and can rotate secrets on a schedule. Learning to put a secret in a managed store and read it back through…
What you'll learn
- why plaintext secrets in config are a risk
- storing a secret in a managed secrets store
- controlling access with IAM instead of file permissions
- auditing and rotating secrets centrally
- choosing Secrets Manager vs Parameter Store
Steps in this lab
- Why a managed store beats a config file
- Pick your store: Secrets Manager vs Parameter Store
- Store a secret
- Read it back through controlled access
- Scope access with IAM (least privilege for secrets)
- Rotate, and clean up
- Why this is where secrets are supposed to live