SSH: Daily key generation and rotation with a 2FA registration system. Keys come from this local daemon, once per ui session / 12 hours. Port knocking to get th

SSH: Daily key generation and rotation with a 2FA registration system. Keys come from this local daemon, once per ui session / 12 hours. Port knocking to get through bastions. All bastions and config done via enterprise managed setup. You're not on a managed machine, you're not on prod/vpn/ssh/etc. SSL: AWS KMS style solution which predates it on internal, and new system built on KMS. These systems are merging as KMS takes a lot of the load off. Then it's down to building a key distribution system. All secrets actually stored in this type of system. Devs rarely access secrets directly. Lots of nice "client" wrappers which look like DynamoDBClient, or Mysql driver but actually fetch passwords on a 5 minute rotation from the secret store so a rotation means push new key, wait 5 minutes, pull old keys. Secrets preferably never hit disk. Not a big fan of vault because it wants to connect in to your hosts to manage and rotate passwords.