HashiCorp Vault Dynamic Database Credentials with Cassandra
summary
Demo configures HashiCorp Vault to issue ephemeral Casandra credentials, creates three different users with a 2-minute TTL and shows the last one expire and fail to log in, proving revocation works. Uses cqlsh to connect, inspects Vault audit logs, and shows necessary edits: enable basic auth and role-based access in cassandra.yaml, Java 8 preferred while Java 10–12 need GC tweaks, and a missing logs directory must be created. All steps and scripts live in a GitHub repo.
AI-written summary · about
chapters (16)
- 0:00Introduction to dynamic secrets
- 1:48Why database secrets matter
- 3:56Challenges of dynamic secrets
- 5:23How Vault centralizes security
- 6:46Benefits of dynamic secrets
- 10:19Demo setup and logging
- 12:29Enabling secrets engine
- 13:53Configuring database plugin
- 14:59Creating roles and TTL
- 16:02Requesting credentials
- 17:30Testing ephemeral access
- 18:35Reviewing audit logs
- 19:19Privilege bracketing in action
- 20:24Security principles recap
- 21:46Cassandra setup requirements
- 23:10GitHub resources and Q&A
related talks
27mWho's managing the credential for your data infrastructure?
44mSecret Management with Hashicorp's Vault
43mSecret Management with Hashicorp's Vault
40mA Better Way To Manage Secrets
28mSecret Management with Hashicorp´s Vault
32mThe End of Shared Passwords with Vault and Boundary
30mEfficiently share and manage secrets across applications with HashiCorp Vault
29mHow to get dynamic with secrets management