Zero Touch Machine Secret Access with Vault
summary
Claim: machines get zero‑touch identity by using ACME-issued x509s from a private CA (step CA or Boulder) to authenticate to Vault's cert auth backend. Implementation uses Terraform to create Vault roles, an ACME CA, and Vault Agent AutoAuth; certificates rotate automatically (tests used 10‑minute certs with renewals ~every 6 minutes). Deployed in a resin stack for ~a year with one renewal failure; production design adds monitoring, CRL automation, and region-local CA mirrors.
AI-written summary · about
chapters (10)
- 0:00Introduction to zero touch
- 2:13The first secret problem
- 4:44Ineffective solutions
- 7:55Current options and gaps
- 11:02Leveraging DNS and ACME
- 12:55Private PKI infrastructure
- 16:22Configuration and terraform
- 20:56Client implementation
- 22:15Operational experience
- 24:11Best practices and conclusion
related talks
49mZero Trust Security
42mZero Trust security with HashiCorp Vault and AWS (PRT239)
27mIntegrating Vault and Terraform with Enterprise Machine Identity Services
44mSecret Management with Hashicorp's Vault
42mZero-Knowledge Architecture, or Leak-Free Secrets, with HC Vault
45mZero-knowledge Architecture, or Leak-free Secrets, with HC Vault
36mEdge Security in Untrusted IoT Environments
51mRun modern PKI workflows with HCP Vault on AWS