Secrets management
Secret rotation and audit log
Rotating an Autessa secret replaces its value and bumps its version by one, while every tool keeps working because tools refer to secrets by name. Each secret keeps an audit log, readable by people with Manage, of every create, edit, share, rotation, seal and delete, every use by a tool per host and run, every denial and every reveal, never the value.
The problem
What problem does it solve?
Credentials that are hard to rotate never get rotated. And when something goes wrong, the first question is “who used this key, from where?”
How it works
- 1
Get the new value
If the provider allows two active keys, keep the old one active for now.
- 2
Rotate
Open the secret, click Rotate, paste the new value. Executions that start from now on use it.
- 3
Watch the log
Check for USE events after the rotation.
- 4
Revoke the old key
Then revoke it at the provider.
Every option
Secret rotation and audit log: settings and options
| Setting | What it does |
|---|---|
| CREATE, UPDATE, ROTATE, SEAL, DELETE, SHARE | Someone changed the secret or who has access. |
| USE | Once per execution per host, with the tool and host. Signature checks record the host hmac. |
| USE_DENIED | A tool asked and was not allowed. |
| REVEAL_REQUEST, REVEAL_APPROVE, REVEAL_DENY, REVEAL, REVEAL_DENIED | The reveal trail. |
| Delete | Erases the value immediately; tools that refer to it fail with SECRET_USE_DENIED. |
| Bundles | Exports list the secrets tools need, never values. Import asks the receiving company for its own. |
Permissions
Who can do what?
| Who | What they can do |
|---|---|
| Manage | Rotate, delete and read the audit log. |
| Scheduled or triggered runs | Appear in the log as the user the run is attributed to. |
FOR DEVELOPERS
What to know
- Audit entries describe the tool, host, request and changed fields; they never contain the value.
Connections
How Secret rotation and audit log connects to the rest of Autessa
Reports, policies and security questionnaires are on the Autessa Trust Center.
FAQ
Secret rotation and audit log: questions
Do I have to update my tools when I rotate a key?
No. Tools refer to the secret by name, and every execution after the rotation uses the new value.
Can I see which tool used a secret and where it was sent?
Yes. Each USE event records the tool, the execution and the host.
Get started with Secret rotation and audit log
Rotating a secret bumps its version while tools keep working by name, and each secret keeps an audit log of every change, share, use, denial and reveal, never the value.
Reports, policies and questionnaires live on the Autessa Trust Center.
100% customizable, code and all
Make Autessa Security & Compliance fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours