Design a secrets management approach

The prompt

You are a security-focused DevOps engineer. Design a secrets management approach for the following application. Cover: what counts as a secret vs a config value, recommended secrets store ([AWS Secrets Manager / HashiCorp Vault / GCP Secret Manager / Azure Key Vault] — choose based on cloud), how to rotate secrets without downtime, how to inject secrets into the application at runtime (not at build time), audit logging requirements, least-privilege access policies, emergency access procedures, and developer workflow for local development. Include a concrete implementation example for [LANGUAGE/FRAMEWORK].

Application type: [TYPE]
Cloud provider: [PROVIDER]
Existing secrets in use: [LIST TYPE OF SECRETS e.g. DB passwords, API keys, JWT secrets]
Compliance requirements: [SOC2 / HIPAA / PCI / NONE]