Securing AWS Accounts With HashiCorp Vault
summary
Runs a Vault server, enables the AWS secrets engine, and creates an s3-role that issues policy-bound short-lived IAM credentials limited to S3. Vault issues ephemeral access key and secret via CLI, the AWS CLI uses them to list buckets, and a Vault revoke call deletes the credentials so they disappear from the IAM console—proof it works. Emphasizes dynamic secrets with lease/TTL, automatic rotation, audit logging, and cross-cloud applicability for managing full lifecycle of AWS keys.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:44Problem with static secrets
- 3:56Why secrets management
- 6:27HashiCorp Vault overview
- 7:55AWS Secrets Manager vs Vault
- 10:41Dynamic secrets explained
- 12:54Demo setup
- 15:42Live demo walkthrough
- 20:45Key takeaways and summary
related talks
31mSecure Your Multi-Cloud Delivery Pipeline with HashiCorp Vault
28mServerless Secrets with HashiCorp Vault
30mSimplifying Secrets Management in the Public Cloud
29mHow to get dynamic with secrets management
38mKeeping Secrets - A Practical Approach to Managing Credentials
44mSecret Management with Hashicorp's Vault
41mHiding secrets in a Vault
30mHashiCorp Vault and Jenkins - Leveraging AWS IAM to Empower a Hybrid Scenario