The End of Shared Passwords with Vault and Boundary
summary
A concrete system using HashiCorp Vault and Boundary to eliminate shared database passwords by creating on-demand dynamic Postgres users with a 24-hour TTL and enforcing least-privilege roles (developer vs DBA). The demo shows Boundary Connect CLI requesting Vault credentials, provisioning a temporary Postgres user, and opening a tunneled session where developers are denied admin operations; deployment is on Kubernetes and configuration is managed with Terraform. Audit session retention is limited in the Community Edition (last hour) while full history requires the Enterprise edition.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:31Shared password problem
- 5:47Vault and Boundary overview
- 7:09How Vault works
- 8:11Boundary security role
- 10:14Live demo
- 14:07Technical setup
- 22:33Conclusion
- 23:55Q&A
related talks
27mWho's managing the credential for your data infrastructure?
53mDynamic Database Credentials
31mModern Security with Microservices and the Cloud
29mZero Trust Security and Identity Management with Boundary
44mWho's managing the credentials for your database?
40mEvent Driven Access Controls
27mStop the (Password) Insanity! - Managing Credentials with HashiCorp Vault
39mExplore HashiCorp Boundary