Design a Secret Management Service

Requirements

• •Store and serve secrets with envelope encryption: each secret encrypted with a data encryption key (DEK), DEK encrypted with a key encryption key (KEK) stored in HSM
• •Support automatic secret rotation with zero downtime: both old and new versions served during a transition window
• •Generate dynamic secrets on-demand (e.g., temporary DB credentials with a 1-hour TTL) using a dynamic backend
• •Enforce fine-grained ACLs: workloads can only access the specific secrets they need (principle of least privilege)
• •Produce a tamper-evident audit log of every secret read, write, rotation, and access denial

Non-Functional Requirements

• •Secret read latency < 10ms (p99, cached)
• •HSM must be the trust anchor: root key operations never happen in software
• •Audit log: every access event written within 100ms, tamper-evident
• •System handles 100,000 secret read requests/second

Constraints

• •Secrets include: API keys, database passwords, TLS certificates, encryption keys
• •All secrets must be encrypted at rest and in transit
• •The encryption root key must never exist in plaintext in software memory

Evaluation Criteria