How should secrets management be designed for production in Cloud Security?

Use a vault, workload identity, short-lived credentials, automated rotation, and tightly scoped retrieval permissions. The implementation should be justified by measurable requirements, kept as simple as the problem allows, and validated with realistic tests, telemetry, failure handling, and documented tradeoffs.