Keeping Secrets - A Practical Approach to Managing Credentials

on YouTube ↗38m

" summary

Uses HashiCorp Vault as Vault as system of record with Consul HA storage, per-user tokens, and audited TLS access; CI (Rake + s_build gem) retrieves secrets into memory, builds environment‑agnostic Docker images, then Terraform deploys to AWS ECS/ECR and injects secrets as environment variables at start time — never writing them to disk. Workflows create ephemeral PR deployments for validation then destroy them, support AWS backend dynamic credentials, and enforce a weekly restore drill and inject secrets at runtime.

AI-written summary · about

" chapters (9)

1. 0:00Intro
2. 1:28The Problem
3. 5:23What is Vault
4. 7:08Storage backends
5. 13:40Procedures
6. 17:05Basal
7. 21:35Prepare
8. 25:30Deploy
9. 31:07Questions

" related talks

• 40mA Better Way To Manage SecretsJohnny T · Ruby Hack 2019
• 28mSecret Management with Hashicorp´s VaultDaniel Bornkessel · ContainerDays Hamburg 2018
• 43mSecret Management with Hashicorp's VaultDaniel Bornkessel · GOTO Berlin 2018
• 28mHow to Store Secrets—and When Do You Need Them—in HashiCorp VaultGuy Barros · HashiTalks 2021
• 41mHiding secrets in a VaultStjepan Hadjić · Voxxed Days Vienna 2017
• 50mDevOps: Shhhh! It's a secret! - HashiCorp VaultGrzegorz Piotrowski · 4Developers 2020
• 29mBehind Closed Doors: Managing Passwords in a Dangerous WorldNoah Kantrowitz · PyCon AU 2016
• 30mEfficiently share and manage secrets across applications with HashiCorp VaultMizan Rahman · HashiConf 2024