Catalog
technology#Security#Platform#DevOps#Integration

HashiCorp Vault

Centralized secrets management for secure storage, access control, and dynamic provisioning of keys, certificates, and API credentials.

HashiCorp Vault is a secrets management and data protection system for securely storing, accessing, and distributing credentials, API keys, certificates, and encryption keys.
Established
High

Classification

  • High
  • Technical
  • Technical
  • Intermediate

Technical context

Database plugins (MySQL, Postgres, MSSQL)Cloud KMS and secret backends (AWS KMS, Azure Key Vault)CI/CD tools and orchestrators (Jenkins, GitHub Actions, Kubernetes)

Principles & goals

Centralized management instead of distributed secret storesLeast privilege principle in policiesAutomation of rotation and lifecycle
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Single point of failure without high-availability architecture
  • Misconfigured policies can lead to over-privileged access
  • Faulty migration or key rotation can cause outages
  • Enforce least-privilege principle in policies
  • Use automatic rotation for short-lived secrets
  • Enable audit logging and review regularly

I/O & resources

  • Authentication backend (e.g. AppRole, Kubernetes, LDAP)
  • Definition of policies and roles
  • Backend storage and key management for Vault unseal
  • Secure secrets with access restrictions
  • Audit logs and access evidence
  • Automatically generated short-lived credentials

Description

HashiCorp Vault is a secrets management and data protection system for securely storing, accessing, and distributing credentials, API keys, certificates, and encryption keys. It centralizes secret lifecycle management, enforces fine-grained access policies, and provides audit logging and dynamic secrets to reduce credential sprawl across infrastructure and applications.

✔

  • Reduces secret exposure and hard-coded credentials
  • Supports dynamic, short-lived credentials
  • Centralized auditing and policy enforcement

✖

  • Operation and HA require infrastructure and operational effort
  • Complex policy and role modeling for large environments
  • Network dependency can affect latency or availability

  • Number of stored secrets

    Measures total number of secrets managed in Vault and indicates scope and growth.

  • Average latency for secret retrievals

    Time between request and response; important for services' performance SLAs.

  • Secret rotation frequency

    Frequency at which secrets are automatically rotated; indicator of security hygiene.

Central secrets for a SaaS platform

A SaaS provider uses Vault to centrally manage database passwords and API keys to restrict permissions and enable auditing.

Dynamic DB credentials in CI/CD

CI/CD pipelines fetch short-lived database credentials from Vault, removing long-lived credentials from pipelines.

Internal PKI for microservices

A company runs an internal PKI via Vault to automatically issue and renew TLS certificates for internal services.

1

Plan: define requirements, auth backends, storage and HA.

2

Install: deploy Vault servers and configure storage backend.

3

Configure: create auth methods, policies, roles and secrets engines.

4

Integrate: connect and test applications and pipelines.

5

Operate: establish monitoring, backup, rotation and incident processes.

⚠️ Technical debt & bottlenecks

  • Legacy, manually managed secrets that still need migration
  • Missing automation for secret rotation in some services
  • Insufficient monitoring of Vault performance under load
Network latency between clients and VaultAPI request rate limits under loadComplexity of policy and role modeling
  • Using Vault tokens with unlimited lifetime for services
  • Storing sensitive keys in an unencrypted backend
  • Directly sharing root unseal keys instead of using a KMS
  • Underestimating operational effort for HA and backups
  • Faulty policy tests lead to outages in production services
  • Ignoring audit logs and alerts on unusual accesses
Knowledge in security, PKI and access controlOperational experience with distributed systems and HA architecturesExperience with policy design and automation (Terraform, CI/CD)
Secure key management and rotationCentralized access control and auditabilityIntegration with service discovery and CI/CD
  • • Requirement for secure storage backends (e.g. consistent KMS)
  • • Network accessibility and firewall rules must be adjusted
  • • Dependency on supported auth and secret backends