Cloud Infrastructure Security: HashiCorp Vault
Hardcoding database passwords, API tokens, and TLS private keys inside application source code or environment variables exposes organizations to disastrous security leaks. If a Git repository or CI/CD container is compromised, static long-lived credentials grant attackers permanent database access.
HashiCorp Vault is the industry-standard identity-based secret management and data protection system. Vault secures, stores, and tightly controls access to tokens, passwords, certificates, and encryption keys. Rather than managing static secrets, Vault generates Dynamic Credentials on demand with automatic Time-to-Live (TTL) expiration and revokes compromised access instantly. This guide details Vault's architecture, Shamir unseal mechanisms, dynamic secrets, PKI engines, and Kubernetes sidecar injection.
Mental Model: Static Hardcoded Secrets vs HashiCorp Vault Dynamic Secret Injection
Static secret management relies on distributing shared API tokens or environment variables across application instances. Static secrets are rarely rotated due to operational friction, increasing credential exposure windows to months or years.
HashiCorp Vault Dynamic Secrets fundamentally shifts security to zero-trust short-lived credentials.
When a microservice requests database access, Vault connects to the database engine, creates a ephemeral database user (e.g., v-approle-db-172938), grants precise SQL permissions, and returns the temporary username/password with a 1-hour TTL. When the lease expires, Vault drops the database user automatically. For security architecture patterns, review securing microservices api gateway kong keycloak and securing web applications owasp top 10 mitigation.
Quick reference
- Eliminates long-lived static database passwords and API keys from source code and config files.
- Generates short-lived dynamic credentials with automatic Time-to-Live (TTL) lease expiration.
- Vault revokes compromised credentials dynamically without requiring application restarts.
- Provides central audit logging of every secret read, write, and authentication event.
- Supports Kubernetes service account auth, AWS IAM, OIDC, and AppRole identity methods.
Remember this
Adopt HashiCorp Vault dynamic secrets to eliminate static hardcoded credentials in production environments.
Vault Architecture: Storage Backends, Shamir Secret Sharing, & Seals
Vault's architecture segregates storage from encryption keys:
- Storage Backend (Raft / Consul): Stores encrypted secret payloads. The storage backend has no capability to read secret contents because all data is encrypted before storage. - Master Key & Shamir's Secret Sharing: When Vault initializes, it generates a Master Key encrypted using AES-256 GCM. Vault splits the master key into multiple key shares using Shamir's Secret Sharing algorithm (e.g., requiring 3 out of 5 key shares to unseal Vault). - Auto-Unseal via Cloud KMS: In production cloud environments, AWS KMS, GCP KMS, or Azure Key Vault automatically unseal Vault nodes upon restart without human key-share intervention.
Quick reference
- Storage backends store raw encrypted payloads; storage nodes cannot decrypt secret data.
- Shamir's Secret Sharing requires a threshold of key shares (3-of-5) to unseal Vault manually.
- Auto-Unseal uses Cloud KMS (AWS/GCP/Azure) for hands-off automated node restarts.
- High-Availability (HA) Raft storage clusters replicate encrypted secret states across nodes.
- Vault barrier seals immediately during security breach alerts, locking down all secret access.
Remember this
Configure Cloud KMS Auto-Unseal and integrated Raft storage for resilient HA Vault operations.
Dynamic Database Credentials, PKI Certificate Engine, & Encryption as a Service
Vault provides specialized secret engines beyond key-value storage:
1. Database Secret Engine: Generates ephemeral PostgreSQL / MySQL credentials:
1path "database/creds/read-only-role" {2 capabilities = ["read"]3}2. PKI Secrets Engine: Acts as an internal Certificate Authority (CA), dynamically issuing TLS certificates (x509) for microservices with short 24-hour TTLs, eliminating manual SSL certificate renewal processes. 3. Transit Engine (Encryption-as-a-Service): Encrypts sensitive application data (credit card numbers, PII) in transit via API calls without storing data in Vault.
Quick reference
- Database Engine generates ephemeral PostgreSQL/MySQL users with configurable TTL leases.
- PKI Engine acts as a internal CA, issuing short-lived mTLS certificates for microservices.
- Transit Engine performs AES-GCM data encryption/decryption via REST API calls.
- Applications offload cryptographic operations to Vault without managing encryption keys.
- Automatic lease renewal and revocation endpoints streamline lifecycle management.
Remember this
Use Vault's PKI and Transit engines to automate mTLS certificate issuance and field-level data encryption.
Kubernetes Agent Sidecar Injection & AppRole Authentication
Integrating Vault with Kubernetes applications requires zero code modifications using Vault Agent Sidecar Injector.
Deploying pod annotations (vault.hashicorp.com/agent-inject: "true") instructs the Vault Mutating Webhook to inject a sidecar container. The Vault Agent authenticates using the pod's native Kubernetes ServiceAccount token, fetches dynamic secrets, and writes them to an in-memory shared volume (/vault/secrets/config.env).
For non-Kubernetes worker nodes, AppRole authentication uses a RoleID and SecretID pair to grant application instances scoped secret read access.
Quick reference
- Vault Agent Sidecar Injector uses K8s mutating webhooks for zero-code secret injection.
- Authenticates securely using native Kubernetes ServiceAccount JWT tokens.
- Renders secrets into shared in-memory tmpfs volumes (/vault/secrets/config.env).
- AppRole authentication grants non-K8s worker nodes scoped secret access via RoleID/SecretID.
- Vault Agent automatically renews secret leases and updates config files before expiration.
Remember this
Inject Vault Agent sidecars into Kubernetes pods to render dynamic secrets into in-memory volumes securely.
Key takeaway
To test HashiCorp Vault, launch a dev server via Docker (docker run -p 8200:8200 vault). Enable a KV engine (vault secrets enable -path=secret kv-v2) and write your first secret.
Related Articles
Explore this topic