Secrets Management, Rotation, Driver Credentials, Audit Evidence, and Incident Response

Learning outcomes

AtlasMart rotates a database password and every application instance goes down because the password was copied into three repositories, a Dockerfile, a CI variable and an old runbook. Secret management is not “where do we put the password?”; it is a lifecycle with issuance, constrained delivery, use, rotation, revocation, evidence and recovery.

Reproducible AtlasMart setup

$env:NEO4J_URI='bolt://127.0.0.1:7687'$env:NEO4J_USER='neo4j'$env:NEO4J_PASSWORD='atlasmart-course-2026'$env:NEO4J_DATABASE='neo4j'py -3 -m venv .venv.\.venv\Scripts\Activate.ps1python -m pip install --upgrade pippython -m pip install neo4j==6.3.0

CYPHER 25CREATE CONSTRAINT customer_id IF NOT EXISTSFOR (c:Customer) REQUIRE c.customerId IS UNIQUE;CREATE CONSTRAINT product_id IF NOT EXISTSFOR (p:Product) REQUIRE p.productId IS UNIQUE;CREATE CONSTRAINT order_id IF NOT EXISTSFOR (o:Order) REQUIRE o.orderId IS UNIQUE;MERGE (c:Customer {customerId:'C-1001'})SET c.name='Mina Rahimi', c.tier='GOLD', c.tenantId='TENANT-A'MERGE (p:Product {productId:'P-1001'})SET p.name='Trail Camera', p.category='Cameras', p.price=129.90MERGE (o:Order {orderId:'O-5001'})SET o.status='PAID', o.tenantId='TENANT-A', o.orderedAt=datetime('2026-09-08T16:30:00Z')MERGE (c)-[:PLACED]->(o)MERGE (o)-[r:CONTAINS]->(p)SET r.quantity=1, r.unitPrice=129.90;

These are course-only credentials and synthetic records. The fixture deliberately includes tenantId because authorization mistakes often appear when a graph traversal crosses a tenant boundary even though authentication succeeded.

1. Inventory every secret-bearing surface

2. Rotate a native password safely

ALTER USER atlasmart_serviceSET PASSWORD $newPasswordCHANGE NOT REQUIRED;

$env:NEO4J_URI='neo4j+s://db.example.com:7687'$env:NEO4J_USER='atlasmart_service'$env:NEO4J_PASSWORD=(Get-Content -Raw .\run\secrets\neo4j_password).Trim()python .\app.py

In a real orchestrator, the file would be a managed secret mount, not a repository file. Rotation order depends on the authentication mechanism: avoid a window where all clients still use the retired secret, and verify new sessions before revoking old access when dual-token/provider mechanisms permit it.

3. Rotating token credentials in the Python driver

from neo4j import GraphDatabasefrom neo4j.auth_management import AuthManagers, ExpiringAuthimport timedef get_token():    token = fetch_token_from_identity_provider()    return ExpiringAuth(token).expires_in(55)auth_manager = AuthManagers.bearer(get_token)driver = GraphDatabase.driver(    "neo4j+s://db.example.com:7687",    auth=auth_manager,)

The auth manager supports credentials expected to rotate, such as SSO bearer tokens. It does not magically make long external side effects idempotent or repair authorization. The provider callback itself is privileged code: protect its client credentials and failure behavior.

4. Wrong patterns and concrete failure

5. Evidence: what can you actually audit?

Audit data is itself sensitive. Protect log access, retention and export paths; avoid DEBUG token/JWT claim logging in production unless a short troubleshooting window explicitly requires it.

6. Incident-response mini playbook

7. Backup and admin paths are part of secrets architecture

A graph may be perfectly protected over Bolt while a world-readable backup, mounted data directory or orchestration secret leaks the entire database. Restrict backup directories, private keys, configuration, plugin directories and admin scripts at the OS/container/cloud layer. Neo4j’s security checklist specifically treats filesystem and backup access as security controls, not housekeeping.

Production judgment

Summary and next step

Secrets are revocable capabilities with owners and evidence, not strings hidden from Git. Lesson 5 combines identity, RBAC, TLS, secrets, extension and admin paths into one threat model and verifies concrete defenses against realistic graph-application abuse.

Authoritative references

• Current Neo4j versions — Current server and 5.26 LTS release snapshot.
• Security checklist — Official baseline for deployment, transport, extensions, backup and filesystem security.
• Manage users — Native users, password handling, Community/Enterprise user-model distinctions.
• Role-based access control — Enterprise RBAC model and GRANT/DENY/REVOKE semantics.
• Read privileges — TRAVERSE, READ and MATCH graph privilege semantics.
• Write privileges — CREATE, DELETE, SET, MERGE and WRITE privilege semantics.
• SSL framework — Bolt/HTTPS TLS policies, certificate files, TLS levels and URI schemes.
• Procedure/function privileges — Execute and boosted-execution privilege boundaries.
• Python driver advanced connections — TLS/trust and rotating authentication token support in the maintained Python driver.
• Logging — Community/Enterprise log availability, including query/security log boundaries.
• Aura user management — Managed-service roles and distinction between Aura console roles and DB-level RBAC.
• Recover admin user/password — Break-glass recovery and network-isolation precautions.