Environment Configuration and Secrets Management

You are a DevOps security engineer who manages application configuration. Design a configuration and secrets management strategy.

Application: [DESCRIBE APPLICATION]
Environments: [DEV / STAGING / PROD]
Secrets types: [API KEYS / DATABASE / ENCRYPTION KEYS / OAUTH]
Infrastructure: [AWS / GCP / AZURE / K8S]
Compliance: [SOC2 / HIPAA / PCI / NONE]
Team size: [NUMBER OF DEVELOPERS]

Provide:

**Configuration Categories**
```
1. Build-time Config
   - Feature flags
   - API URLs
   - Public keys

2. Runtime Config
   - Database connections
   - Cache settings
   - Timeouts

3. Secrets
   - API keys
   - Database passwords
   - Encryption keys
```

**Environment File Structure**
```
.env.example          # Template with dummy values
.env.local            # Local development (gitignored)
.env.development      # Dev environment defaults
.env.staging          # Staging overrides
.env.production       # Production (minimal, most from secrets manager)
```

**Secrets Management**

Recommended Tool: [AWS Secrets Manager / HashiCorp Vault / etc.]

```[language]
// Secrets loading pattern
const config = {
  database: {
    host: process.env.DB_HOST,
    password: await secretsManager.get('db-password')
  }
};
```

**Secret Rotation**
- Rotation schedule
- Zero-downtime rotation procedure
- Automation scripts

**Access Control**
| Secret | Dev | Staging | Prod |
|--------|-----|---------|------|
| DB Password | read | read | restricted |

**Configuration Validation**
```[language]
// Startup validation
function validateConfig() {
  const required = ['DATABASE_URL', 'API_KEY'];
  // Validation logic
}
```

**Documentation**
| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| API_URL | Yes | - | Backend API endpoint |

**Security Checklist**
- [ ] Secrets not in version control
- [ ] Secrets not in logs
- [ ] Principle of least privilege
- [ ] Encryption at rest
- [ ] Audit logging enabled

**Emergency Procedures**
- Secret rotation on breach
- Access revocation
- Incident response

You are a DevOps security engineer who manages application configuration. Design a configuration and secrets management strategy.

Application: [DESCRIBE APPLICATION]
Environments: [DEV / STAGING / PROD]
Secrets types: [API KEYS / DATABASE / ENCRYPTION KEYS / OAUTH]
Infrastructure: [AWS / GCP / AZURE / K8S]
Compliance: [SOC2 / HIPAA / PCI / NONE]
Team size: [NUMBER OF DEVELOPERS]

Provide:

**Configuration Categories**
```
1. Build-time Config
   - Feature flags
   - API URLs
   - Public keys

2. Runtime Config
   - Database connections
   - Cache settings
   - Timeouts

3. Secrets
   - API keys
   - Database passwords
   - Encryption keys
```

**Environment File Structure**
```
.env.example          # Template with dummy values
.env.local            # Local development (gitignored)
.env.development      # Dev environment defaults
.env.staging          # Staging overrides
.env.production       # Production (minimal, most from secrets manager)
```

**Secrets Management**

Recommended Tool: [AWS Secrets Manager / HashiCorp Vault / etc.]

```[language]
// Secrets loading pattern
const config = {
  database: {
    host: process.env.DB_HOST,
    password: await secretsManager.get('db-password')
  }
};
```

**Secret Rotation**
- Rotation schedule
- Zero-downtime rotation procedure
- Automation scripts

**Access Control**
| Secret | Dev | Staging | Prod |
|--------|-----|---------|------|
| DB Password | read | read | restricted |

**Configuration Validation**
```[language]
// Startup validation
function validateConfig() {
  const required = ['DATABASE_URL', 'API_KEY'];
  // Validation logic
}
```

**Documentation**
| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| API_URL | Yes | - | Backend API endpoint |

**Security Checklist**
- [ ] Secrets not in version control
- [ ] Secrets not in logs
- [ ] Principle of least privilege
- [ ] Encryption at rest
- [ ] Audit logging enabled

**Emergency Procedures**
- Secret rotation on breach
- Access revocation
- Incident response