Map where each secret is used
Identify the secret’s consumers, environments, permissions, and renewal requirements. Check runtime configuration, scheduled jobs, build steps, and external integrations so a forgotten consumer does not fail after cutover.
Where the provider supports overlapping credentials, create the replacement with the least required access and deploy it while the old value remains valid. Confirm the application can authenticate and perform its required operation using the new value.
Revoke and verify
After all consumers use the replacement, revoke the previous credential and check for authentication failures. Avoid printing values during diagnosis; use secret references or masked status indicators.
Document ownership, rotation timing, and recovery steps. If rotation reveals an unknown dependency, restore service with the approved process, update the inventory, then resume revocation rather than leaving an old key indefinitely.