Operations
Rotate keys and credentials
Inventory, staged rotation, revocation, and recovery checks for platform credentials.
Procedure specification — not yet operationally validated. Before pilot use, the operations owner must attach exact console/API/CLI actions, environment identifiers, access requirements, escalation contacts, and rehearsal evidence. No platform command names or completed drills are implied here.
Rotation inventory
Cover artifact-signing keys, runtime mTLS CA/certificates, OIDC credentials, GitHub App keys, object-storage credentials, organization secret-wrapping keys, integration credentials, SCIM bearer tokens, and break-glass authenticators. Each inventory entry needs an owner, scope, key/version ID, expiry, rotation method, affected consumers, and recovery procedure. Never include plaintext key material in the inventory or audit.
Routine rotation
- Identify dependencies, distribution paths, trust overlap, and any historical artifacts or backups that require the old verification/decryption key.
- Create the replacement through the approved KMS or provider workflow; preserve organization/environment scope and least privilege.
- Distribute replacement trust before changing issuers where the protocol supports overlap. Validate with nonproduction and a controlled canary.
- Switch signing, client authentication, certificate issuance, or runtime secret resolution to the new version as appropriate.
- Verify artifact checks, cluster reconciliation, login, source access, backup access, or integration calls for the affected credential class.
- Revoke retired credentials after the documented overlap and acceptance checks. Keep required historical verification/decryption access under retention policy.
- Audit key IDs, actors, affected scopes, times, and outcome. No secret value belongs in evidence.
Boundary-specific checks
- Artifact signing: old legitimate artifacts must remain verifiable under the approved trust policy; a compromised signer needs an explicit decision about affected artifacts.
- Cluster mTLS: rotate CA trust and leaf certificates without granting one cluster another cluster's scope. Confirm rejected old credentials after cutover.
- OIDC and SCIM: validate new sign-in/provisioning and deprovisioning; token replacement must not suspend lifecycle enforcement unnoticed.
- Wrapping keys: prove retained backups and secret versions can still decrypt before retiring keys.
- Integrations: credentials resolve at runtime; ordinary rotation must not require rebuilding the app.
- Break-glass: verify recovery access with strong MFA and visible audit/alerts, while keeping routine access disabled.
Suspected compromise
Use incident response for immediate containment and revocation. Routine overlap windows must not preserve a compromised credential merely for convenience. Record any resulting service interruption and recovery verification.