Encryption-as-a-Service with Vault's Transit Secret Engine

on YouTube ↗27m

" summary

Vault Transit acts as encryption-as-a-service: keys never leave Vault, data is sent over TLS and Vault returns ciphertext for storage. Demo shows enabling the Transit secrets engine, creating keys (e.g. AES-256, RSA options), using the HVAC Python library and raw API calls to encrypt/decrypt base64 payloads, rotate keys and rewrap ciphertext, and enable convergent encryption for repeatable ciphertext used in indexed queries. Code and workflow are shown end-to-end with a PostgreSQL demo.

AI-written summary · about

" chapters (13)

1. 0:00Introduction to talk
2. 0:22Why encrypt data in plain text
3. 1:26Vault Transit Secrets Engine overview
4. 3:08Transit engine features explained
5. 7:03Developer workflow with Transit
6. 10:54Enabling and setting up Transit
7. 14:26Live demo setup
8. 16:11Basic encryption and decryption
9. 17:36Integrating Transit in Python
10. 20:26Demo application in action
11. 22:51Key rotation process
12. 25:03Convergent encryption demo
13. 26:25Summary and Q&A

" related talks

• 40mA Better Way To Manage SecretsJohnny T · Ruby Hack 2019
• 51mIntroduction to VaultSeth Vargo · GOTO London 2015
• 31mModern Security with Microservices and the CloudSeth Vargo · ScaleConf Colombia 2018
• 41mModern Security with Microservices and the CloudSandeep Dinesh · NDC Oslo 2018
• 30mSimplifying Secrets Management in the Public CloudKevin Tuffner · HashiTalks 2019
• 26mVault + Distributed SQL: Protecting Data Where it LivesAndy Manoske · Distributed SQL Summit Asia 2021
• 29mIntro to secrets management using VaultMouhcine Narhmouche · BlaBlaConf 2022
• 50mDevOps: Shhhh! It's a secret! - HashiCorp VaultGrzegorz Piotrowski · 4Developers 2020