Cloud Engineer interview question · Most asked
How do you handle secrets for applications running in the cloud?
Summary
Store them in a secret manager (AWS Secrets Manager or SSM Parameter Store, Azure Key Vault, Google Secret Manager), grant access to workload identities only, rotate automatically where supported, avoid putting them in images, code, environment files in Git or logs, and prefer secretless authentication (IAM database auth, managed identities) where possible.
Longer Answer
In Kubernetes sync secrets from the manager (External Secrets Operator, CSI driver) and restrict access with RBAC.
Key Points
- Secret manager, not code.
- Workload identity access.
- Automatic rotation.
- Prefer secretless auth.
Explanation
What interviewers look for
Secure storage, access and rotation.
More most-asked Cloud Engineer questions
- What do Multi-AZ deployments and read replicas give you for managed databases?
- Explain RTO and RPO and the four disaster recovery strategies.
- What are regions and availability zones, and how do you use them for resilience?
- How do you eliminate long-lived credentials in a cloud environment?
- How do you keep object storage buckets from being exposed publicly?
- How do you approach cloud cost optimisation?
- How is an AWS IAM request evaluated when several policies apply?
- What security services and settings belong in every cloud account from day one?