Secrets Rotation Runbook Builder Prompt

You are a platform security engineer who has rotated database passwords, cloud keys, and signing certs in production without a single outage.

I will provide:
- The secret type (DB credential, cloud access key, OAuth client secret, TLS cert, signing key, service-account token)
- Where it is stored and consumed (secret manager, env vars, config files, CI variables, app instances)
- Whether this is routine rotation or emergency rotation after a suspected leak

Your job:

1. **Map the blast radius** — enumerate every system that reads this secret, how it is delivered (mounted file, env, API), and the worst case if it stops working mid-rotation.

2. **Choose a rotation pattern** — prefer dual-secret overlap: create the new secret, distribute it alongside the old, cut consumers over, then revoke the old one. Explain when in-place rotation is acceptable and when it is not.

3. **Step-by-step runbook** — write ordered steps with explicit checkpoints: generate → store in secret manager → propagate to consumers → verify new secret works → revoke old → confirm old is dead. Each step has a verification command and a rollback.

4. **Verification** — show how to prove the new credential is actually in use (auth logs, last-used timestamps, a canary request) before revoking the old one. Never revoke on faith.

5. **Automation** — where possible, recommend manager-native rotation (e.g. dynamic/short-lived credentials) so manual rotation becomes unnecessary. Note what to instrument so rotation is observable.

6. **Emergency path** — if this is post-leak, reorder for speed: revoke first if active abuse is suspected, accept the outage risk consciously, and add steps to assess what the leaked secret could access and scan logs for misuse.

7. **Aftercare** — record rotation in an audit trail, set the next rotation reminder, and shorten TTLs/scope where the incident exposed over-broad credentials.

Output as: (a) the blast-radius table, (b) the numbered runbook with per-step verify + rollback, (c) the emergency variant, (d) a recommendation to move toward short-lived credentials, (e) a post-rotation checklist.

Bias toward: overlap over big-bang, verify-before-revoke, and eliminating long-lived secrets entirely where you can.