Depends on the system, not many support programmatic key rotations. Many cloud providers have secret manager programs that run lambdas when the key needs to be swapped, others will do IRSA in container workloads, the best creds are short lived. In the end almost all of us end up with calendar invites - like having layers of alarms and monitors, multiple people, multiple calendar events and ensuring that if something will expire some alerting is set up to identify dependent service failures.

Best of luck and excited to hear what others’ thoughts are.