At Uber, we run over 5,000 microservices, 5,000 databases, and over 500,000 analytical jobs per day to support millions of people worldwide using our apps. Over 150,000 secrets facilitate authentication among these large, distributed ecosystems with multiple stakeholders. This also includes over 400 third-party vendor integrations and 400 SaaS applications. Cyberattacks continue to rise industry-wide, with exposed credentials being a leading cause. With this in mind, we set out on a mission to build a centralized, automated, and scalable solution for secrets management. To combat secrets sprawl, shadow IT vaults, and insecure secret sharing, and to facilitate the rotation of secrets when necessary, we kicked off a transformative journey building a Secret Management Platform. We assembled a set of thought leaders within the company to define Uber’s Secret Management Standard and a visionary solution (Figure 1). In this article, we’ll share how we built Uber’s Secret Management Platform, solving key challenges and setting a new standard for secrets management.

The Uber Engineering Blog offers insights, technical deep dives, and updates on the engineering challenges and solutions behind Uber's platform and services. Covering topics such as distributed systems, data infrastructure, and mobile development, the blog provides resources for developers interested in large-scale systems and real-world engineering problems. Developers can learn about Uber's technology stack, engineering culture, and best practices for building scalable and reliable systems.

Uber Engineering

Uber has developed a centralized multi-cloud Secret Management Platform to enhance security across its complex ecosystem of microservices and databases. By consolidating secret vaults, automating secrets rotation, and improving secret governance, Uber reduces the risk of cyberattacks and manages secret sprawl efficiently. The platform includes automated secret rotation and a Secure Secret eXchange system for third-party vendors, supporting agility and robust security protocols across multiple deployment environments.

Building Uber’s Multi-Cloud Secrets Management Platform to Enhance Security

Enabling Secret Auto-Rotation and Deletion

Facilitating Secret Exchange with Third-Party Vendors