Configuration, Secrets, and Data Migration
This domain tests two coupled ideas: runtime configuration must live outside the artifact, and schema change must be decoupled from code change so both old and new versions can run at once.
Configuration rules
Externalise configuration so one artifact runs in every environment (twelve-factor style). Non-secret values live in version control or a parameter store and are validated against a schema at startup; secrets come from a secret manager. Configuration baked into the artifact forces a rebuild per environment and destroys the build-once guarantee.
Secrets rules
- Never in git, images, build logs or
.tfvars. Use Vault, AWS Secrets Manager, Azure Key Vault or equivalent. - Prefer short-lived, least-privilege credentials - workload identity or OIDC federation instead of static keys.
- Rotation must be automatic and must not require a redeploy; read at start or subscribe to changes.
- Encrypt in transit and at rest, audit access, and scope each workload to only its own secrets.
Migration patterns
Use versioned, forward-only migrations (Flyway, Liquibase) applied by the pipeline, idempotent, and rehearsed against a production-like copy. Decouple schema from code with expand/contract, the multi-deploy sequence.
Worked example
Renaming customer_name to full_name during a rolling deployment: deploy 1 adds full_name as nullable and dual-writes both columns; a throttled, resumable backfill copies historical rows in batches; deploy 2 switches reads to full_name while still dual-writing; deploy 3 stops writing customer_name; deploy 4 drops it. A single-step RENAME breaks instantly because old instances still query the dropped column.
Traps that cost marks
- Renaming or dropping a column in the same release as the code change.
- Backfilling millions of rows in one transaction, locking writes for minutes.
- Believing that rewriting git history removes a leaked secret - rotate it, then purge.
- Config keys that exist in one environment and not another, with no schema validation to catch it at startup.