Vault & AWS Lambda: Towards a Sub Minute Recovery
summary
Vault Enterprise plus AWS Lambda automates promotion and DNS failover to reach sub-minute recovery. Architecture uses four Lambdas: an auth lambda that signs payloads and returns Vault tokens, a scheduled dr operation token every 8 hours pushed to Secrets Manager, a dR-operations lambda that demotes/promotes and links clusters, and a DNS-switch lambda that flips Route 53 weighted records (weights 255/0). Terraform repos deploy the functions and policies; Lambda code is Node.js and Python. Demo shows endpoint swap and full failover in under a minute.
AI-written summary · about
chapters (4)
related talks
25mSecuring and Scaling AWS with Terraform, Vault, and Veeam: A Practical Guide
41mAutomating Multi-Cloud, Multi-Region Vault for Teams and Landing Zones
27mVault At Scale
29mDesigning High Availability for HashiCorp Vault in AWS
28mServerless Secrets with HashiCorp Vault
39mBuilding Resilient Serverless Applications
29mHow to get dynamic with secrets management
32mWhizBangLambdaFix: where AWS Misconfigurations...