An apparatus comprising: one or more computer readable storage media; and a secret rotation service including program instructions stored on the one or more computer readable storage media, wherein the program instructions, when executed by one or more processing systems of a key master service, KMS, system (152A - 152N), direct the one or more processing systems to: rotate one or more secrets being served by the KMS system; provide other components of a secret distribution infrastructure with rotation information identifying the one or more secrets; validate that the one or more secrets have been rotated at the other components of the secret distribution infrastructure; and once validated, publish the rotation information to a metadata storage service, wherein each of the one or more secrets includes multiple sub-secret instances, and wherein only one of the multiple sub-secret instances is active at any given time, and wherein to rotate the one or more secrets, the program instructions, when executed by the one or more processing systems, further direct the one or more processing systems to: for each secret of the one or more secrets, deactivate a first sub-secret instance of the secret that is activated, and activate a second sub-secret instance of the secret that is deactivated. one or more computer readable storage media; and a secret rotation service including program instructions stored on the one or more computer readable storage media, wherein the program instructions, when executed by one or more processing systems of a key master service, KMS, system (152A - 152N), direct the one or more processing systems to: rotate one or more secrets being served by the KMS system; provide other components of a secret distribution infrastructure with rotation information identifying the one or more secrets; validate that the one or more secrets have been rotated at the other components of the secret distribution infrastructure; and once validated, publish the rotation information to a metadata storage service, wherein each of the one or more secrets includes multiple sub-secret instances, and wherein only one of the multiple sub-secret instances is active at any given time, and wherein to rotate the one or more secrets, the program instructions, when executed by the one or more processing systems, further direct the one or more processing systems to: for each secret of the one or more secrets, deactivate a first sub-secret instance of the secret that is activated, and activate a second sub-secret instance of the secret that is deactivated. rotate one or more secrets being served by the KMS system; provide other components of a secret distribution infrastructure with rotation information identifying the one or more secrets; validate that the one or more secrets have been rotated at the other components of the secret distribution infrastructure; and once validated, publish the rotation information to a metadata storage service, wherein each of the one or more secrets includes multiple sub-secret instances, and wherein only one of the multiple sub-secret instances is active at any given time, and wherein to rotate the one or more secrets, the program instructions, when executed by the one or more processing systems, further direct the one or more processing systems to: for each secret of the one or more secrets, deactivate a first sub-secret instance of the secret that is activated, and activate a second sub-secret instance of the secret that is deactivated. for each secret of the one or more secrets, deactivate a first sub-secret instance of the secret that is activated, and activate a second sub-secret instance of the secret that is deactivated.