Building a Repeatable and Hardened Vault POC
summary
Builds a repeatable, hardened Vault POC: automated image creation with Packer, TLS via Let's Encrypt certs, deployment with Terraform using a three-node Vault cluster and Consul storage backend on AWS, then configures Vault with the Terraform Vault provider, audit logging to Datadog, and user/policy setup so the root token can be revoked. Shows unseal with 3-of-5 keys, uses private subnets and autoscaling groups, and demonstrates the build works end-to-end.
AI-written summary · about
chapters (10)
- 0:00Introduction and Vault basics
- 4:15Why harden Vault infrastructure
- 7:00Infrastructure as code approach
- 9:11Image creation with Packer
- 11:01Terraform deployment in AWS
- 14:10Unsealing and validating Vault
- 17:01Automated Vault configuration
- 21:38Centralized logging setup
- 23:23Revoking root token and final steps
- 26:56Q&A and production considerations
related talks
23mHashiCorp Vault and Getting Day 2 Operations Right
29mAutomating Vault deployments: Patterns, pitfalls, and practical lessons
29mAdopting HashiCorp Vault: Deployment, Adoption, and Beyond
46mVault configuration as code via HashiCorp Terraform - Stories from trenches
23mBuilding a Secure AWS Golden Image Pipeline with Packer, Vault and Terraform
41mAutomating Multi-Cloud, Multi-Region Vault for Teams and Landing Zones
42mHCP Vault Learn Lab: Operations with Terraform
51mRun modern PKI workflows with HCP Vault on AWS