Reviewed by Aditya Kumar · Last reviewed 2026-03-24
**Why dedicated secret managers**: AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault—encrypted, audited, rotated. **Never**: In code, config files in git, or .env in production. **Runtime injection**: Environment variables, mounted files, workload...
Why dedicated secret managers: AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault—encrypted, audited, rotated. Never: In code, config files in git, or .env in production. Runtime injection: Environment variables, mounted files, workload identity. For pipelines: Airflow Connections, Kubernetes Secrets, or IAM roles (prefer no keys when possible). Scalability: Centralized secrets scale with least-privilege; rotation without redeploy. Cost implications: Secret managers have per-secret cost; consolidate where practical. Best practice: Rotate regularly; least privilege; audit access; use CI secrets for deployments.
Red Flag: 'We use .env files' or hardcoded credentials. Pro-Move: 'Secrets in Vault; Airflow connections pull at runtime; IAM for cloud services.'
According to DataEngPrep.tech, this is one of the most frequently asked SQL interview questions, reported at 1 company. DataEngPrep.tech maintains an editor-reviewed database of 1,863 data engineering interview questions across 7 categories.