Lifecycle management of secrets on serverless platform

1. A computing system, comprising:

a management system that includes a plurality of different secret type-specific systems corresponding to a plurality of different types of secrets, wherein

each secret type-specific system, of the plurality of different secret type-specific systems, is specific to a corresponding type of secret of the plurality of different types of secrets and configured to perform a different replacement process to replace a secret of a corresponding type of secret, that is used by a dependent system, with a new secret of the corresponding type of secret, and

the management system includes control functionality configured to isolate execution of each replacement process of the plurality of different secret type-specific systems;

at least one processor; and

memory storing instructions executable by the at least one processor to provide an orchestration engine configured to:

identify a secret, of a given type, to be replaced;

call a particular secret type-specific system, of the plurality of different secret type-specific systems, based on the given type to be replaced, wherein the particular secret type-specific systems performs a replacement process to replace the secret of the given type with a new secret of the given type; and

store the new secret in a secrets data store for use by the dependent system.

2. The computing system of claim 1 wherein the management system exposes an application programming interface (API) that is called by the orchestration engine to replace the secret of the given type.

3. The computing system of claim 1 , wherein the control functionality comprises serverless control functionality that implements the management system on a serverless platform.

4. The computing system of claim 3 wherein the serverless control functionality is configured to isolate execution of each replacement process based on a dependent resource or dependent service that uses the secret being replaced.

5. The computing system of claim 1 wherein the secret type-specific system comprises:

secret acquisition logic configured to acquire the new secret of the given type.

6. The computing system of claim 5 wherein the secret type-specific system comprises:

secret whitelisting logic configured to whitelist the new secret of the given type for access by the dependent system.

7. The computing system of claim 6 wherein the secret type-specific system comprises:

secret revocation logic configured to interact with the dependent system to indicate that the new secret of the given type is whitelisted and to receive an indication from the dependent system indicating when the dependent system is configured to use the new secret of the given type and generate a revocation output indicating that the dependent system is configured to use the new secret of the given type.

8. The computing system of claim 7 wherein the orchestration engine comprises:

data store interaction logic; and

rotation logic configured to receive the new secret of the given type and the revocation output and control the data store interaction logic to replace the secret of the given type with the new secret in the secrets data store.

9. The computing system of claim 1 wherein the orchestration engine comprises:

secret rotation identifier configured to scan rotation criteria to identify the secret of the given type that is to be replaced based on the rotation criteria.

10. The computing system of claim 9 wherein the orchestration engine comprises:

rotation approval logic configured to interact with an approval system corresponding to the identified secret of the given type to obtain approval to replace the secret of the given type.

11. A computer implemented method, comprising:

identifying a plurality of different secrets, each of a different secret type, to be replaced;

calling a plurality of different secret type-specific systems, implemented on a serverless platform, that each correspond to a different type of secret and that each perform a different replacement process, based on the corresponding type of secret to replace the secret of the corresponding type of secret, that is used by a dependent system, with a new secret of the corresponding type;

isolating each different replacement process based on the dependent system that uses the secret being replaced; and

storing the new secret in a secrets data store, when it has been replaced for use by the dependent system.

12. The computer implemented method of claim 11 wherein the secret type-specific system performs a type-specific replacement process by:

executing secret acquisition logic to acquire the new secret of the corresponding type.

13. The computer implemented method of claim 12 wherein the secret type-specific system performs the type-specific replacement process by:

executing secret whitelisting logic to whitelist the new secret of the corresponding type for access by the dependent system.

14. The computer implemented method of claim 13 wherein the secret type-specific system performs the type-specific replacement process by:

executing secret revocation logic to interact with the dependent system to indicate that the new secret of the corresponding type is whitelisted and to receive an indication from the dependent system indicating when the dependent system is configured to use the new secret of the corresponding type and generate a revocation output indicating that the dependent system is configured to use the new secret of the corresponding type.

15. The computer implemented method of claim 11 wherein identifying a secret comprises:

intermittently scanning rotation criteria to identify the secret of the corresponding type that is to be replaced based on the rotation criteria.

16. A computing system, comprising:

a plurality of different secret type-specific-systems corresponding to a plurality of different types of secrets, wherein

each secret type-specific system, of the plurality of different secret type-specific systems, is specific to a corresponding type of secret of the plurality of different types of secrets and configured to perform a different replacement process to replace a secret of a corresponding type of secret, that is used by a dependent system, with a new secret of the corresponding type of secret;

serverless control functionality configured to isolate execution of each replacement process of the plurality of different secret type-specific systems on a serverless platform;

at least one processor; and

memory storing instructions executable by the at least one processor to provide an orchestration engine configured to:

identify a secret, of a given type, to be replaced;

call a particular secret type-specific system, of the plurality of different secret type-specific systems, based on the given type to be replaced, wherein the particular secret type-specific systems to performs a replacement process to replace the secret of the given type with a new secret of the given type; and

store the new secret in a secrets data store for use by the dependent system.

17. The computing system of claim 16 , and further comprising an application programming interface (API) that is called by the orchestration engine to replace the secret of the corresponding type of secret.

18. The computing system of claim 16 , wherein the particular secret type-specific system is configured to acquire the new secret of the given type.

19. The computing system of claim 18 , wherein the particular secret type-specific system is configured to:

whitelist the new secret of the given type for access by the dependent system.

20. The computing system of claim 19 , wherein the particular secret type-specific system is configured to:

interact with the dependent system to indicate that the new secret of the given type is whitelisted and to receive an indication from the dependent system indicating when the dependent system is configured to use the new secret of the given type and generate a revocation output indicating that the dependent system is configured to use the new secret of the given type.