rotation

Rotation is an expand-contract migration for credentials: stage the new secret, prove every reader picked it up, revoke the old one, and treat the revocation as the test. The outage risk lives in clients and connection pools, not in Terraform.

Encryption is the part people focus on and the least interesting part. What you are buying is short-lived credentials, a revocation path and an audit trail, none of which an environment variable can give you.

An incident response question wearing a Git costume. The wrong instinct is to rewrite history first, and it costs you the hour that matters.

Tool selection is the shallow half of secrets questions. Senior answers live in the mechanics: dual-validity windows, consumer caching, and revocation you have actually tested rather than assumed.

This is a machine identity problem wearing a secrets costume. Candidates who start at encryption miss that authentication of the caller and delivery mechanics are the real design space.