MediumExperience level: 3-5 years · 8-15 years1 min read

How do you manage configuration and secrets across many microservices?

Reviewed by Gurusankar M.

Asked inAmazonDeloitteCognizantAccenture
#config#externalized configuration#secrets#12-factor#config server
Report issue

Short Answer

Externalize config from code (12-factor): inject via environment variables / a config service (Spring Cloud Config, Consul) / Kubernetes ConfigMaps, and keep secrets in a secrets manager (Vault, AWS Secrets Manager / K8s Secrets) — never in the repo. Support per-environment overrides and, ideally, dynamic refresh.

On this page

Concept Made Simple

Coffee Chat Question

“How do you manage configuration and secrets across many microservices?”

Remember It Faster

Mind Map Answer

Config
env vars / config server / ConfigMap
Secrets
Vault / Secrets Manager (NOT in git)
Per-env
dev/stage/prod overrides
Bonus
dynamic refresh without redeploy

Think Beyond the Expected

What If?

A DB password is committed to the repo — what's the remediation?

Treat it as compromised: rotate the credential immediately, purge it from history (and assume it's leaked), then move it to a secrets manager injected at runtime. Add secret-scanning to CI to prevent recurrence. Rotating is non-negotiable — removing the commit doesn't un-leak it.

Real World

12-factor externalized config + a secrets manager is standard; the recurring incident is secrets committed to git, which is why secret-scanning and rotation policies exist.

Interviewer's Expectation

Keywords they're listening for:

  • externalize config (12-factor)
  • secrets in a manager not git
  • per-env overrides
  • dynamic refresh
  • rotate leaked secrets

Common Mistakes

  • Hardcoding config/secrets in the repo
  • Same config across environments
  • Not rotating leaked credentials

Best Practices

  • Externalize all config; secrets in a manager
  • Per-environment overrides
  • Secret-scan CI + rotation policy

Follow-up Questions

  1. Why is config in code an anti-pattern?
  2. How does dynamic config refresh work?
  3. How do K8s Secrets differ from a Vault?

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: Service Design (Microservices)
Interview question: "How do you manage configuration and secrets across many microservices?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Affiliate links

Tools for Your Developer Workspace

Equipment for a comfortable, productive setup.

As an Amazon Associate I earn from qualifying purchases.