Any service that requires credentials should be designed and implemented in a manor that allows credential rotation at any time with low or no risk. I would en

Any service that requires credentials should be designed and implemented in a manor that allows credential rotation at any time with low or no risk. I would encourage people to test this process on a regular basis. You could even automate this process in your dev or staging environments to minimize risk in the event that a code change breaks credential rotation. You can take this a step further and implement something like Vault [1] so that nobody on the team knows the credentials until they for whatever reason need to use them. They make a request to vault and there is a log entry that they pulled the credentials. This sets a good pattern and a good story for future audits. [1] - https://www.vaultproject.io/ https://www.vaultproject.io/