Credential rotation
Credential rotation replaces an existing credential with a new one, updates the systems that depend on it, and retires the old credential.
Creating the replacement is only part of the change
For an application credential, rotation includes the systems that store and use it. AWS describes updating both the stored secret and the target service. Google Cloud’s service-account key process includes distributing the replacement, disabling the old key, checking applications, and deleting the replaced key.
Where a platform supports overlapping credentials, a planned transition can let applications switch before the old credential stops working. The overlap also leaves the old credential usable until it is disabled. A suspected compromise needs an incident decision about that exposure, not an automatic maintenance grace period.
The app credential article explains why the application identity, owner, and existing permissions matter. Issuing a new secret does not reduce the application’s authority.
Check what retirement actually stops
Credential rotation and session revocation are separate operations. Google Cloud, for example, documents that disabling a service-account key does not revoke short-lived credentials already issued from it. Other systems have their own rules.
Record which credential was replaced, which dependencies moved, and what access may remain. A successful new connection does not prove the old credential has stopped working.
The integration-token guide and containment review explain why credential replacement also needs an investigation when exposure is suspected.