Secrets rotation
Track credential adoption, not only rotation-job success
A completed automation run does not show that every consumer moved. Measure target validity, consumer refresh and retirement of the previous authority separately.
In this article
Define the stages of success
Record whether the replacement was created, accepted by the target, made available to consumers and adopted by the required clients. Then record the previous credential's retirement under the chosen strategy.
Do not combine these into one success flag before all required evidence exists. A target update can succeed while publication or consumer refresh fails.
Keep secret values out of the measurement. Safe version references and test outcomes are sufficient for most operational evidence.
Account for infrequent consumers
Maintain an inventory with each consumer's expected refresh or execution interval. A job that runs monthly may not appear in a short observation window.
Exercise it through an equivalent controlled path or keep its adoption status explicitly pending. Silence is not evidence that it no longer uses the credential.
Track the oldest unresolved consumer and its owner so a mostly complete rotation does not leave one service dependent on the old value indefinitely.
Measure service impact
Observe authentication failures, refresh errors and operation latency during the transition. Distinguish expected bounded retries from repeated failures that interrupt work.
Check backlog and eventual operation results where consumers pause. A rotation can avoid visible web errors while silently delaying background processing.
For an illustrative ten-consumer rotation, nine successful refreshes should be reported as nine of ten with the remaining scheduled job named in controlled records. A 90 percent figure alone does not tell the operator whether retirement is safe.
Verify the final boundary
Test that the replacement has the intended permissions and that old use fails when the policy requires revocation. The exact check depends on the target's session and credential model.
Record whether existing authenticated sessions remain valid and how that affects the security objective. Credential replacement and session termination are not always the same operation.
Acceptance should show a usable replacement, completed consumer transition and the intended removal of old authority. Those facts provide more confidence than a green scheduler entry.
Primary sources
OWASP: secrets managementReferences checked 11 September 2026.