HashiCorp Vault is a secrets management, encryption, and identity-based access tool used to securely store, manage, and control access to sensitive information such as passwords, API keys, tokens, certificates, and encryption keys.
🔑 Core Capabilities of Vault
1️⃣ Secrets Management
- Centralized store for sensitive credentials (DB passwords, API keys, SSH keys, etc.)
- Supports dynamic secrets: Vault can generate short-lived credentials for databases, cloud providers, or services on demand.
2️⃣ Data Encryption as a Service (EaaS)
- Provides encryption/decryption APIs so applications can encrypt data without managing encryption keys themselves.
- Supports key rotation and policies without changing application code.
3️⃣ Identity-Based Access
- Integrates with identity providers (LDAP, Kubernetes, AWS IAM, etc.) to authenticate users and apps.
- Enforces fine-grained access policies via HashiCorp’s policy language (HCL).
4️⃣ Secrets Leasing & Revocation
- All credentials have leases (time-to-live).
- Supports revoking individual secrets or entire trees of secrets immediately to reduce exposure.
5️⃣ Audit Logging
- Records every access and operation for compliance and security monitoring.
📌 Where Vault Is Used
- Cloud & Multi-Cloud Environments: Manage secrets across AWS, Azure, GCP consistently.
- Kubernetes: Dynamically inject secrets into pods using Vault Agent or CSI driver.
- DevOps/CI-CD Pipelines: Provide temporary secrets for builds, deployments, and automation.
- Zero Trust Architectures: Combine Vault with tools like Boundary for identity-driven, just-in-time access.
✅ Example Use Case
- Application needs a database password.
- App authenticates to Vault (using AppRole, JWT, or Kubernetes auth).
- Vault generates a dynamic, short-lived DB credential and returns it.
- Credential automatically expires or is revoked after TTL.
🔗 TL;DR
Vault is HashiCorp’s platform for securing secrets and sensitive data, offering:
- Centralized secret storage
- Dynamic credentials
- Encryption as a service
- Identity-based access control
- Audit logging
It’s widely used in DevOps, cloud-native, and security-first environments to implement least privilege and zero-trust security models.