A Better Way To Manage Secrets
summary
Shows concrete use of HashiCorp Vault: a dev server and Vault Ruby gem demo that uses the transit encryption backend to encrypt SSNs, returns ciphertext to store in the app, and decrypts via Vault so keys never live in the database. Demonstrates dynamic DB credentials and AWS creds with leases, explains renewal and revocation, notes defaults like 32‑day max TTL and 1‑hour token TTL, covers audit logging, Shamir unseal, HA and real compliance wins (PCI DSS).
AI-written summary · about
chapters (25)
- 0:00Intro
- 2:11What Are Secrets?
- 3:25Current Way - Static
- 4:42Current Way - Encryption
- 7:18HashiCorp Vault
- 9:37Vault is Complex
- 10:29Example Setup
- 11:27Dev Server Setup
- 12:05Static Secret Setup
- 12:40Static Secret Use
- 13:17Encryption Setup
- 14:36Encryption Use
- 16:21Remove Root
- 18:44Policies
- 19:04App Policy
- 20:16Static Secret - Token
- 20:56Static Secret - Default
- 21:55Authentication
- 24:01Revisit Encryption
- 26:38Renewing Leases
- 28:25Dynamic Secrets
- 30:55Audit Logs
- 32:40Other Vault Stuff
- 36:41Secret Management
- 37:55Questions / Resources
related talks
38mKeeping Secrets - A Practical Approach to Managing Credentials
28mSecret Management with Hashicorp´s Vault
41mHiding secrets in a Vault
44mSecret Management with Hashicorp's Vault
43mSecret Management with Hashicorp's Vault
28mHow to Store Secrets—and When Do You Need Them—in HashiCorp Vault
50mDevOps: Shhhh! It's a secret! - HashiCorp Vault
30mEfficiently share and manage secrets across applications with HashiCorp Vault