Inventory consumers without copying secrets
| Credential reference | Consumer | Owner | Verification |
|---|---|---|---|
| Database writer credential | Background import worker | Integration owner | Synthetic write using new access |
| Message provider key | Notification service | Operations owner | Provider-approved test message route |
| Release credential | Deployment job | Release owner | Isolated deployment and permission check |
OWASP treats creation, rotation, revocation and expiry as separate parts of a secret’s lifecycle. Before scheduling, check the provider’s current rules: whether two credentials can coexist, how revocation works and which permissions the new one needs. Do not assume every provider supports an overlap window.
Verify both the new and old state
- Create least-privilege replacement
- Update known consumers
- Verify safe test operations
- Revoke and check old access
If a credential is suspected compromised, use the incident response plan rather than prolonging its use for convenience.
The main service works after rotation but a nightly worker still fails. What did the plan miss?
Show the worked answer
A separate consumer or environment may still use the old reference. Inspect the inventory and controlled configuration, update that consumer and test its scheduled task. Do not paste either key into logs to debug it.