| name | implementing-secrets-management-with-vault |
| description | This skill covers deploying HashiCorp Vault for centralized secrets management across cloud environments, including dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes integration. It addresses eliminating hardcoded credentials from application code and CI/CD pipelines by implementing short-lived, automatically rotated secrets.
|
| domain | cybersecurity |
| subdomain | cloud-security |
| tags | ["hashicorp-vault","secrets-management","dynamic-secrets","credential-rotation","zero-trust"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"] |
Implementing Secrets Management with Vault
When to Use
- When applications store database passwords, API keys, or certificates in environment variables or config files
- When migrating from static long-lived credentials to dynamic short-lived secrets
- When Kubernetes workloads need secure access to database credentials or cloud provider APIs
- When compliance requirements mandate centralized credential management with audit logging
- When CI/CD pipelines contain hardcoded secrets that represent supply chain risk
Do not use for AWS-only environments where AWS Secrets Manager suffices without multi-cloud requirements, for application-level encryption logic (though Vault Transit can help), or for identity federation (see managing-cloud-identity-with-okta).
Prerequisites
- HashiCorp Vault server deployed in HA mode (Consul or Raft storage backend)
- TLS certificates for Vault listener endpoints
- Vault Enterprise license for namespaces, Sentinel policies, and replication (optional)
- Kubernetes cluster with Vault Agent Injector or CSI provider for workload integration
Workflow
Step 1: Deploy Vault in High Availability Mode
Deploy Vault using Integrated Storage (Raft) for HA without external dependencies. Configure TLS, audit logging, and auto-unseal using a cloud KMS.
# vault-config.hcl
storage "raft" {
path = "/opt/vault/data"
node_id = "vault-node-1"
retry_join {
leader_api_addr = "https://vault-node-2.internal:8200"
}
retry_join {
leader_api_addr = "https://vault-node-3.internal:8200"
}
}
listener "tcp" {
address = "0.0.0.0:8200"
tls_cert_file = "/opt/vault/tls/vault.crt"
tls_key_file = "/opt/vault/tls/vault.key"
}
seal "awskms" {
region = "us-east-1"
kms_key_id = "alias/vault-unseal-key"
}
api_addr = "https://vault-node-1.internal:8200"
cluster_addr = "https://vault-node-1.internal:8201"
telemetry {
prometheus_retention_time = "30s"
disable_hostname = true
}
vault operator init -key-shares=5 -key-threshold=3
vault audit enable file file_path=/var/log/vault/audit.log
vault audit enable syslog tag="vault" facility="AUTH"
Step 2: Configure Authentication Methods
Enable authentication backends for human operators, applications, and CI/CD pipelines. Use AppRole for machine authentication and OIDC for human access.
