HashiCorp Vault

Vault gives a system one interface for every secret it needs, whether that is a database credential, an API key for an external service or a certificate. The difficulty it addresses is bookkeeping: knowing who reached which secret is already platform specific and awkward, and adding key rolling, encrypted storage and an audit trail on top usually means a custom solution nobody wants to own.

Instead, secrets are read through Vault, which enforces tight access control and records a detailed audit log of every request. Storage backends vary, from local disk to Consul and others.

What matters is how secrets are issued and taken away.

• Secure storage: arbitrary key and value pairs encrypted before they are written, so raw storage access is not enough to read them.
• Dynamic secrets: credentials generated on demand for systems such as AWS or SQL databases, then revoked automatically once the lease ends.
• Encryption without storage: data encrypted and decrypted by Vault while living elsewhere, letting security teams set the parameters and developers keep ciphertext in a SQL database.
• Leasing and renewal: every secret carries a lease, with built in APIs for clients to renew before it expires.
• Revocation: single secrets or whole trees revoked at once, for instance everything read by one user, which helps with key rolling and with locking a system down after an intrusion.

Vault is written in Go and builds from source once the toolchain is in place. HashiCorp publishes documentation, tutorials, example applications in several languages and a certification exam.