HashiCorp Vault

When to Use

• Dynamic Secrets: Generating temporary AWS credentials (TTL 15m) for a specific task.
• Encryption as a Service: Encrypting application data (Credit Cards) without the app managing the keys (Transit Engine).
• Kubernetes Secrets: Injecting secrets into pods securely without Etcd.

Quick Start (Dev Mode)

vault server -dev
export VAULT_ADDR='http://127.0.0.1:8200'

# Write a secret
vault kv put secret/hello foo=world

# Read a secret
vault kv get secret/hello

Core Concepts

Sealing

Engines

• kv

  : Key-Value storage (static).

• aws

  : Dynamic AWS IAM users.

• pki

  : Dynamic x.509 Certificates.

Auth Methods

Best Practices (2025)

• Use Auto-Unseal: Integrate with AWS KMS / Azure Key Vault to unseal automatically (Manual unsealing is painful for uptime).
• Inject via Sidecar: In K8s, use the Vault Agent Injector to drop secrets into

  /vault/secrets/config

  rather than calling the API directly.
• Enable Audit Logs: Essential for knowing "Who read the database password?".

• Don't use Root Token: Generate it, configure auth methods, then revoke it.
• Don't store huge files: Vault is for secrets (KB), not files (MB).

References

• Vault Documentation
• Vault Kubernetes Tutorial