Machine and Nonhuman Identity Security (Secrets Management)
This domain tests secrets management for applications, containers, CI/CD pipelines, and cloud workloads. The core question is how a nonhuman identity proves what it is, retrieves only the secrets it needs, and avoids hardcoded credentials. Expect scenarios involving CyberArk Secrets Manager (Conjur), Application Access Manager (AAM), Central Credential Provider (CCP), and Secrets Hub.
Core rules
- Workloads must authenticate with their own identity, such as a Kubernetes service account JWT, cloud IAM identity, certificate, or platform identity. They should not use human credentials or embedded passwords.
- Conjur policy is defined in YAML and describes layers, hosts, variables, and entitlements. A host can read a variable only if policy grants that entitlement, directly or through a layer.
- Dynamic secrets are generated on demand for databases or cloud services and have short lifetimes. They reduce standing credentials and limit blast radius.
- Secretless access lets a broker make the connection so the application never handles the secret.
- AAM includes CCP and credential providers that retrieve secrets from the Vault for applications. The application identity, such as a hash or certificate, and Safe permissions must be correct.
- Secrets Hub synchronizes secrets from the Vault to cloud-native secret stores. It extends governance; it does not replace the Vault as the source of truth.
- Rotation and audit apply to machine secrets too. Exposed secrets must be rotated, not merely removed from code.
Worked example
A Kubernetes microservice needs a database password. Reasoning: define a Conjur policy with a layer for the application and a host representing the service account; declare a variable for the password; grant the host read entitlement on that variable; configure the pod to authenticate using its projected service account JWT; fetch the secret at runtime; never place it in a ConfigMap, image, or environment variable committed to source control; rotate on schedule and after any exposure.
Traps
- Storing secrets in environment variables or source control because they are convenient.
- Giving every workload the same host identity or broad layer entitlement.
- Using a human privileged account as the application identity.
- Forgetting that CCP requires correct application authentication and Safe permissions.
- Assuming Secrets Hub replaces Conjur or the Vault.
- Removing a leaked secret without rotating it.