Secret Management with Hashicorp's Vault
summary
HashiCorp Vault is shown creating per-instance database users with dynamic secrets that expire (example TTL one hour) and are auto-deleted, plus AWS and Kubernetes auth flows that mint short-lived credentials and can blacklist instance logins after boot. It handles PKI client cert issuance, a transit endpoint for encrypt/decrypt without key export, and an audit log that stores hashed request/response payloads. Storage uses external backends and a master key recovered via Shamir unseal (default 5 keys, 3 required); setup is powerful but has a steep operational learning curve.
AI-written summary · about
chapters (24)
- 0:00Intro
- 1:05Why focus on Vault
- 1:33Other solutions
- 4:54Secret Management: current situation
- 6:06Question
- 6:23Why am I talking about secret management
- 8:04Typical project: Secret Management
- 9:19Vault-executive summary
- 11:04Vault secret backends-dynamic secrets
- 12:49Vault secret backends - Databases
- 15:51Vault secret backends - AWS
- 17:49Vault secret backends - SSH
- 18:37Vault dynamic secret backends - ssh Signed SSH Certificates
- 19:13Vault dynamic secret backends - Transit
- 19:24Vault secret backends-Transit
- 20:57token auth
- 22:29Vault auth backends - external identity providers
- 23:27Github auth
- 23:43Vault auth backends-Kubernetes auth
- 26:27Vault auth backends - AWS auth
- 33:13Vault internals - Audit log
- 35:29Vault internals - storage
- 38:48Vault usage-integration
- 40:52Vault-getting started - interactive tutorial
related talks
44mSecret Management with Hashicorp's Vault
28mSecret Management with Hashicorp´s Vault
30mEfficiently share and manage secrets across applications with HashiCorp Vault
38mKeeping Secrets - A Practical Approach to Managing Credentials
41mHiding secrets in a Vault
40mA Better Way To Manage Secrets
51mIntroduction to Vault
31mVault and Secret Management in Kubernetes