Pick one real credential, rotate it on a quiet day with the people who would do it in an incident, and time each step. The goal is to find the forgotten consumers, missing permissions and unclear owners now, while a failure costs a lunch break instead of an outage.
Why drill
Rotation looks simple on paper: make a new secret, update users, retire the old one. In practice, someone forgot a cron job, a vendor needs a ticket, or only one person knows where the key lives. The first time you find that out should not be during a breach.
OWASP's cheat sheet recommends documenting detection and response procedures and updating them after incidents. A drill is a way to update them before one.
Choose a good target
| Pick | Avoid for a first drill |
|---|---|
| A credential with several consumers | A secret used by exactly one service |
| One with a clear owner | One nobody can name |
| A non critical but real system | Your most critical production database |
One hour plan
- Brief (5 minutes). State the goal, the credential and the rollback.
- Find consumers (10 minutes). Search code, pipelines, config and your inventory for every place it is used.
- Create the new credential (5 minutes). Keep the old one active. The AWS documentation pattern is to create a second key while the first is still active.
- Update consumers (15 minutes). Deploy the new value. Note who needed help.
- Check old use (10 minutes). Look at last used data on the old credential to see what still depends on it.
- Deactivate, then watch (10 minutes). AWS suggests deactivating before deleting, so you can reactivate if something breaks.
- Delete later. After a safe waiting period, remove the old credential.
The dual credential pattern is explained in rotating a secret without downtime.
Record what you learn
Keep a simple sheet:
- Consumers found that were not in the inventory
- Steps that needed a person who was not in the room
- Time from start to old credential disabled
- Anything that broke, and why
- Changes to the runbook
Then fix the runbook
Update the inventory, write down owners, and automate the slowest step. Repeat the drill with a different credential each quarter. Rotation you have practised is rotation you can do when it counts, as in a leaked secret response.
Quick check
How often should we drill?
Once a quarter on a different credential is a reasonable rhythm for a small team. Do one after any real incident too.
Do drills need approval from the business?
Pick a low risk target and give notice. The first drill often proves the value, so later ones get easier to schedule.
Safeguard supports compliance and evidence automation, which can help you keep proof of drills, and a free scan can help build the inventory.
Sources
Last reviewed: 19 October 2026.
