Protecting Your Data in Yugabyte Cloud with HashiCorp
summary
Shows how Yugabyte Cloud and HashiCorp tools combine to enforce identity-first database security: network allowed by IP sets but narrowed to a few terminating gateways that present certificates via Consul and establish mTLS; short‑lived, per‑session credentials generated and revoked by Vault (dynamic users, scoped grants, TTLs) and injected into sessions; human access brokered through Boundary which catalogs targets and proxies Vault credentials; field‑level and format‑preserving encryption (AES FF3‑1) keeps exfiltrated data useless without Vault keys.
AI-written summary · about
chapters (12)
- 0:00Securing Yugabyte Cloud data
- 1:06Data security themes and concerns
- 2:29Identity verification principles
- 5:37Network access and IP controls
- 7:24Machine identity and OAuth/OIDC
- 9:55PKI certificates and gateways
- 12:47Vault for dynamic credentials
- 15:58Boundary for human access
- 18:53Boundary session management
- 20:41Data encryption methods
- 23:11Format-preserving encryption
- 24:59Q&A
related talks
19mTop Security Questions: Delight Your CISO and Protect Your Business
26mVault + Distributed SQL: Protecting Data Where it Lives
27mWho's managing the credential for your data infrastructure?
01mClip 5
24mImproving Security and Observability of YugabyteDB on Kubernetes
30mBuilding Cloud Native Applications on Distributed SQL Platform
36mManaged Zero Trust Security With HashiCorp Cloud Platform
32mThe End of Shared Passwords with Vault and Boundary