HLD-122·Storage & Caching
Easy · 500 ptsMulti-Tenant Secrets & Envelope Encryption Vault
Design a HashiCorp Vault / AWS Secrets Manager service serving encrypted database credentials and API keys during serverless cold-start bursts.
Max p99
≤ 38 ms
Availability
≥ 99.5%
Budget
≤ $2,400
Functional Requirements
- FR-1GET /v1/secrets/{secret_id} — Returns envelope-encrypted secret ciphertext and version metadata.
- FR-2POST /v1/secrets/{secret_id}/rotate — Stores rotated secret version and appends audit record.
- FR-3PATCH & DELETE /v1/secrets/{secret_id} — Updates, revokes, or deletes secret_id entries with bounded TTL or explicit cache/index invalidation.
- FR-4Must survive a 5x backing storage gray latency brownout without starving cold-starting lambdas.
Workload Profile
Baseline Boot Fetches16,000 Read RPS / 500 Rotation Write RPS
Serverless Cold-Start Spike48,000 Read RPS / 1,400 Write RPS
Active Working Set8 GB encrypted tenant secret blobs
Traffic DistributionConcentrated reads on shared prod secret_id keys
Consistency Model
Dual-active grace window during key rotation allows < 5s eventual cache refresh; rotations durably persisted.
Solutions Locked
Sign in and either achieve AC or complete 3 official submissions on this question to inspect community diagrams and writeups.
Loading solutions...
Submission History (0)Select to replay
No submissions yet
Click Submit in the top bar to evaluate against all 7 judge cases and save each run here.
Design Write-up
0 boxes · 0 edges
0 words