We run services in Azure, AWS, and Google Cloud, and each team uses its platform’s native secret manager. A few credentials need to be available in more than one cloud, though, and rotating them without leaving some services on an old value has become awkward.

How are others handling secret rotation across clouds? Do you replicate selected secrets between cloud-native secret managers, use a separate central vault, or avoid synchronization by changing how services authenticate? I’m especially interested in how you handle version changes and rollouts without giving every workload broad access across providers.