Secrets — database passwords, API keys, TLS certificates — are the highest-stakes configuration. Wrong rotation loses audit compliance (SOC 2, PCI). Unrotated secrets lingering after employee departure. API key from GitHub public repo. AWS Secrets Manager and Parameter Store together solve secret lifecycle: storage + versioning + rotation + audit.