6.2.2 Resource Types Supporting Different Types of Dynamic Secret

  • A dynamic secret is a short-lived secret based on the Time-to-Live (TTL) value.

  • A dynamic secret should not be a reconciled account.

    NOTE:Reconcile account is used to provision a dynamic secret. Therefore, a reconciled account cannot be a dynamic secret.

    For example, AWS root password and SSH Certificate Authority are reconcile account credentials that are used to provision dynamic credentials. These credentials cannot be dynamic credentials.