Secrets Retrieval
Domain 4 - Secrets Retrieval
This domain tests how workloads authenticate and fetch secrets from Secrets Manager, including API flows, authenticators, host factory, versioning, and failure handling.
Core rules and concepts
- Retrieval is a two-step flow: authenticate to obtain a short-lived access token, then call GET /secrets/{account}/{kind}/{identifier} with an Authorization header of the form Token token=... .
- Authenticators include authn-jwt for OIDC or JWT, authn-k8s, authn-aws, authn-azure, authn-oidc, authn-ldap, and API key authentication. Prefer platform identity over stored API keys.
- Host factory lets a trusted platform create hosts dynamically using a host factory token. Created hosts inherit layer permissions. Limit and rotate host factory tokens.
- Secret versions can be requested explicitly. Variable retrieval requires execute privilege. Binary secrets should be handled with base64 encoding rather than raw terminal output.
- Clients should cache tokens only until expiry, retry with backoff, and never log secret values. Pin versions where reproducibility matters.
Worked example
A Kubernetes pod uses a projected service account token. It calls the authn-jwt authenticate endpoint for its service ID and account, receives a short-lived token, then calls the secrets endpoint for prod/db/password and injects the value into the process environment at startup. Policy must permit the pod host or its layer execute on that variable. The reasoning: no secret zero is stored, the token is short-lived, and audit ties retrieval to a workload identity rather than a shared API key.
Traps that cost marks
- Using read instead of execute and then wondering why the secret value is denied.
- Sending every read to the leader instead of a local follower or load-balanced endpoint.
- Hardcoding an API key in the container image or source repository.
- Treating a host factory token as a long-lived enrollment secret instead of a tightly scoped, rotated credential.
- Not handling token expiry or retry, causing intermittent pipeline failures.
- Always requesting the latest version when the application needs a pinned version for rollback.