HashiCorp Vault Configuration as Code via HashiCorp Terraform: Stories From the Trenches
summary
Shows a practical path to manage Vault with Terraform: deploy Vault separately from its Terraform-managed configuration, delete root tokens after bootstrap, and use dynamic AWS and database secrets with automated rotation. Reports a persistent pain point: KV data-source caching bug that hides UI changes until a state refresh. Warns Terraform will happily accumulate recycled cloud keys if credential rotation isn’t handled declaratively. Recommends split deployment and configuration, incremental rollout, and rotate DB and AWS creds via Vault but track state carefully.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 4:42Requirements
- 10:37World Configuration
- 12:35Policy Configuration
- 20:12Secret Entrance Configuration
- 27:02KV State Issue
related talks
46mVault configuration as code via HashiCorp Terraform - Stories from trenches
48mConfiguration as Code
42mManage Vault programmatically with Terraform
42mHCP Vault Learn Lab: Operations with Terraform
29mHow to get dynamic with secrets management
23mHashiCorp Vault and Getting Day 2 Operations Right
25mSecure Your Terraform Deploys in GitLab-CI with HashiCorp Vault
25mSecuring and Scaling AWS with Terraform, Vault, and Veeam: A Practical Guide