secretsmgr handbook
Editor sign-in

The three rotations

"Rotation" is used to mean three completely different operations, and confusing them causes outages. The tool uses three different verbs.

CommandWhat changesCan it break your app?When
secretsmgr key rotateYour own keypair. You re-lock your vault keys to your new keyNo. Affects only you, needs nobody's cooperationSuspected key exposure; routine hygiene; new laptop
secretsmgr vault rotate-data-keysThe encryption keys, not the values. Everything is re-encrypted and reads back identicallyNo: guaranteed by design and by testOn a schedule, as routine hygiene
secretsmgr secret rotate (phase 4)The real credential, upstream. The database password genuinely changesYes, if done carelessly, which is why it uses the grace period aboveOffboarding, suspected leak, compliance schedule

One more key change happens on its own: when someone is removed from a vault, the vault gets a fresh vault key for everyone who remains, as part of the removal itself. You never run it; it is what makes taking access away work.

The one to remember

Only the third one is revocation. The first two are hygiene: valuable, but they do not invalidate anything an attacker or an ex-colleague already read.