Enhancing Cloud Foundry Application Security with Vault
summary
Vault is used to generate per-instance, short‑lived credentials and act as an encryption-as-a-service via the transit backend; demo creates a Postgres user, issues AWS IAM keys and revokes them, and issues short‑TTL certs with a CA backend. The Cloud Foundry Vault service broker mounts org/space/instance paths, returns tokens and paths in VCAP_SERVICES, and keeps tokens renewed; one demo credential lasts 30 seconds while another was 768 hours (~1 month). Vault generates per-instance, short‑TTL credentials Cloud Foundry Vault service broker maps tokens and renews them
AI-written summary · about
chapters (22)
- 0:00Introduction and speaker intro
- 1:45Traditional vs cloud security challenges
- 3:11Why Vault was created
- 3:31What is Vault and its features
- 4:14Encryption as a service
- 4:36Dynamic secret generation
- 5:39AWS IAM and certificate generation
- 6:21SSH and TOTP with Vault
- 9:09Vault architecture overview
- 10:33Vault unsealing and Shamir secret sharing
- 11:36Live demo setup
- 12:57Basic CRUD operations in Vault
- 13:39Transit backend encryption demo
- 15:58Dynamic database credentials
- 17:02AWS IAM credentials generation
- 18:48Vault as a certificate authority
- 19:51Cloud Foundry Vault service broker
- 23:41Broker setup and deployment
- 27:49Service broker integration
- 29:04Creating and binding Vault service
- 30:51Application binding and token generation
- 32:38Demo wrap-up and Q&A
related talks
36mManage Distributed Secrets in Applications on Cloud Foundry With Spring Cloud Vault
31mModern Security with Microservices and the Cloud
28mSecret Management with Hashicorp´s Vault
44mSecret Management with Hashicorp's Vault
41mModern Security with Microservices and the Cloud
40mA Better Way To Manage Secrets
31mSecure Your Multi-Cloud Delivery Pipeline with HashiCorp Vault
38mHow To Secure Your MicroServices