The service always stores sensitive values such as API keys, passwords, and certificates as named secrets that can be retrieved only by authorized users and external systems.
The service can create a secret whose value is binary data, such as a certificate or private key file. Providers that accept only string values require the binary content to be encoded before storage.
The service can update the value or metadata of an existing secret after creation, and automatically stores an updated value as a new version of that secret.
The service may be configured with a rotation schedule for a secret; when rotation is due it invokes a user-defined rotation function or publishes a notification so that an external system rotates the value. Providers that only notify leave the stale credential valid until an external system completes the rotation.
The service can disable an individual secret version so that its value can no longer be retrieved, while retaining the version so that it may be re-enabled or destroyed later. Providers without a disable state revoke a version by removing its staging labels, after which the service deletes it without a recovery window.