Vault configuration as code via HashiCorp Terraform - Stories from trenches
summary
HashiCorp Vault is moved into Terraform at HelloHippo using the updated Vault provider to manage servers, auth backends, policies and secret engines; a small Go tool issues Vault tokens and exports 8 hour AWS credentials used to create one‑time sign‑in URLs. Practical findings: Vault initializes with three of five unseal keys, disable TLS termination on load balancers, enable and stream audit logs cross‑account, avoid mixing infra and Vault config in one Terraform run, protect Terraform state, and expect pain rotating DB creds and ownership when using dynamic accounts.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 8:24Vault setup requirements and planning
- 14:50Separating Vault server and config
- 20:31Authentication methods and policies
- 27:38AWS and Kubernetes integrations
- 34:10Temporary credentials for developers
- 38:41Terraform state pitfalls
- 40:31Final thoughts and Q&A
related talks
31mHashiCorp Vault Configuration as Code via HashiCorp Terraform: Stories From the Trenches
48mConfiguration as Code
23mManaging Vault with Terraform
42mHCP Vault Learn Lab: Operations with Terraform
42mManage Vault programmatically with Terraform
25mSecure Your Terraform Deploys in GitLab-CI with HashiCorp Vault
23mHashiCorp Vault and Getting Day 2 Operations Right
29mHow to get dynamic with secrets management