Multicloud and the Chamber of Secrets
summary
A multi-cloud secret inventory initially requires months of manual work across roughly 15 secret types, so Confluent automates discovery with Divi Cloud and Steampipe hooks into HashiCorp Vault (upstream Vault plugin added). Policies automatically pause risky permissions, Terraform PRs gate secret creation with mandatory ownership metadata, and dynamic engines plus a custom Confluent Cloud API key engine handle rotation. Centralized logs flow through Kafka and ksql for anomalous-use alerts; the system is live and has produced zero confirmed compromise incidents.
AI-written summary · about
chapters (11)
- 0:00Multicloud secrets intro
- 1:47Confluent infrastructure
- 3:13Secret management problem
- 4:38Initial secret inventory
- 7:07Modernizing secret inventory
- 8:55Secret value and systems
- 11:01Upscaling secret management
- 13:10Static secrets and exceptions
- 14:14Preventative and monitoring controls
- 17:33Steps to improve secret security
- 19:40Q&A
related talks
30mSimplifying Secrets Management in the Public Cloud
29mManaging Secrets in Your Cloud Environment
14mSecurity lifecycle management in a multicloud world
31mSecure Your Multi-Cloud Delivery Pipeline with HashiCorp Vault
34mWhich Vault? Don't tell me your secret(s)!
41mModern Security with Microservices and the Cloud
38mKeeping Secrets - A Practical Approach to Managing Credentials
43mSecret Management with Hashicorp's Vault