How should secrets management be designed for production in Cloud Security?

Use a vault, workload identity, short-lived credentials, automated rotation, and tightly scoped retrieval permissions.