Secrets, IAM, and RBAC Mental Model
A practical way to reason about identity, permissions, secrets, and access boundaries.
- Status
- evergreen
- Visibility
- public
- Category
- Security
- Difficulty
- intermediate
- Published
- Jun 28, 2026
- Updated
- Jun 28, 2026
Mental Model
Identity says who or what is acting. Authorization says what that identity can do. Secrets are sensitive values used by identities and systems. RBAC is one way to make permissions understandable.
Least Privilege
Start with the smallest useful permission set, then expand only when a real workflow requires it.
Service Accounts
Service accounts should map to workloads or responsibility boundaries, not to convenience. A background worker and a public API often need different permissions.
Secrets
- Keep secrets out of source code.
- Rotate secrets when ownership or exposure changes.
- Prefer managed secret stores.
- Avoid logging config blobs.
- Document who owns each secret and what breaks if it expires.
Access Review Questions
- Who can deploy?
- Who can read production data?
- Who can change secrets?
- Which services can call external providers?
- Which permissions are temporary?
Source Links
Related Notes
Secrets Management Checklist
A checklist for safely handling API keys, database credentials, and service secrets.
GCP for Backend Engineers
A backend-focused map of Google Cloud services for APIs, data, jobs, secrets, and observability.
FastAPI Production Checklist
A compact checklist for taking a FastAPI service from useful prototype to production-ready backend.
GCP Cloud Run Checklist
A deployment checklist for containerized backend services on Google Cloud Run.
Backend and AI Infrastructure Roadmap
A role-readiness roadmap for backend, cloud, data, AI API, and production infrastructure skills.
Backlinks
Secrets Management Checklist
A checklist for safely handling API keys, database credentials, and service secrets.