Efficiently share and manage secrets across applications with HashiCorp Vault
summary
HashiCorp Vault is used to auto‑generate short‑lived credentials for backends like MongoDB and Splunk via dynamic secrets (TTL, automatic rotation, revocation) but requires Vault to have DB admin privileges, depends on Kubernetes/cloud auth, and fails if Vault is unavailable or the backend lacks dynamic support. An alternative is a per‑app utility that calls the backend, writes scoped secrets into Vault paths, integrates with CI/CD (Jenkins/Harness), logs and schedules rotation, and reduces human error though it needs its own secure infrastructure.
AI-written summary · about
chapters (10)
- 0:00Introduction and problems
- 1:59Risks of manual management
- 5:32Mitigating security risks
- 9:02Issues with current processes
- 11:29Risks of direct vault access
- 13:34Using dynamic secrets
- 16:18Dynamic secrets challenges
- 20:34Utility-based solutions
- 27:06Utility implementation risks
- 29:05Choosing the right strategy
related talks
43mSecret Management with Hashicorp's Vault
41mHiding secrets in a Vault
44mSecret Management with Hashicorp's Vault
28mHow to Store Secrets—and When Do You Need Them—in HashiCorp Vault
38mKeeping Secrets - A Practical Approach to Managing Credentials
28mSecret Management with Hashicorp´s Vault
50mDevOps: Shhhh! It's a secret! - HashiCorp Vault
40mA Better Way To Manage Secrets