Vault + Distributed SQL: Protecting Data Where it Lives
summary
Vault Enterprise’s Transform Secret Engine encodes sensitive fields so they can live outside Vault (databases or files) while keeping originals unrecoverable or decryptable only via Vault. It supports AES-FPE (FF3-1) for format‑preserving encryption, tokenization for non‑reversible identifiers, and stores encrypted token mappings in YugabyteDB as secondary storage via a Postgres/YSQL interface. Deploy steps are simple: enable a transform mount, point to a Yugabyte cluster, create schemas and roles; Vault handles keys and uses AES‑256‑GCM and Raft for replication so the setup scales globally and stays performant.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:07About HashiCorp
- 2:25Infrastructure and the Cloud Operating Model: Static to Dynami
- 4:43Dynamic Infrastructure and Security: Identity is Key
- 6:16HashiCorp Vault and Vault Enterprise
- 10:36What Happens when Secrets Live Outside Vault?
- 12:24Transform Secret Engine: Protect Data Outside of Vault
- 15:24Distributed SQL+Vault Transform Tokenization
- 19:23Configuring YugaByte DB as External Storage via PostgreSQL
- 22:56Storing Tokenization Mappings Securely in YugaByte Cloud
related talks
19mTop Security Questions: Delight Your CISO and Protect Your Business
51mIntroduction to Vault
25mProtecting Your Data in Yugabyte Cloud with HashiCorp
27mEncryption-as-a-Service with Vault's Transit Secret Engine
31mModern Security with Microservices and the Cloud
18mBulletproofing your YugabyteDB Infrastructure to Reduce Risk
27mScaling Vault Enterprise with a cell architecture
26mVault in BBVA, Secrets in a Hybrid Architecture