# Secret and database-binding rotation runbook

## Scope

- Organisation and project:
- Binding name:
- Provider/service:
- Current credential version identifier:
- Rotation owner and approver:
- Rollback window:

Never record credential values in this document.

## 1. Prepare

- [ ] Confirm least-privilege role and dependent releases
- [ ] Confirm provider supports overlapping credentials or plan a drain
- [ ] Identify a safe readiness and read/write verification
- [ ] Confirm recovery authority

## 2. Issue

- [ ] Create the new provider credential or identity version
- [ ] Store it through the managed secret path
- [ ] Record only its safe version identifier

## 3. Bind and deploy

- [ ] Update the managed binding
- [ ] Deploy without rebuilding solely to embed a secret
- [ ] Keep the old version valid during the approved overlap

## 4. Verify

- [ ] Readiness passes with the new binding
- [ ] Bounded read/write test passes
- [ ] Error and policy signals remain healthy

## 5. Revoke and prove

- [ ] Revoke the old provider credential
- [ ] Verify the old version can no longer authenticate
- [ ] Close the overlap window
- [ ] Record actors, timestamps, versions and outcomes