secrets-mgmt-vault

name	secrets-mgmt-vault
description	This skill covers deploying HashiCorp Vault for centralized secrets management across cloud environments, including dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes integration. It addresses eliminating hardcoded credentials from application code and CI/CD pipelines by implementing short-lived, automatically rotated secrets.
domain	cybersecurity
subdomain	cloud-security
tags	["hashicorp-vault","secrets-management","dynamic-secrets","credential-rotation","zero-trust"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Implementing Secrets Management with Vault

When to Use

• When applications store database passwords, API keys, or certificates in environment variables or config files
• When migrating from static long-lived credentials to dynamic short-lived secrets
• When Kubernetes workloads need secure access to database credentials or cloud provider APIs
• When compliance requirements mandate centralized credential management with audit logging
• When CI/CD pipelines contain hardcoded secrets that represent supply chain risk

Do not use for AWS-only environments where AWS Secrets Manager suffices without multi-cloud requirements, for application-level encryption logic (though Vault Transit can help), or for identity federation (see mana-clou-iden-okta).

Prerequisites

• HashiCorp Vault server deployed in HA mode (Consul or Raft storage backend)
• TLS certificates for Vault listener endpoints
• Vault Enterprise license for namespaces, Sentinel policies, and replication (optional)
• Kubernetes cluster with Vault Agent Injector or CSI provider for workload integration

Workflow

Step 1: Deploy Vault in High Availability Mode

Deploy Vault using Integrated Storage (Raft) for HA without external dependencies. Configure TLS, audit logging, and auto-unseal using a cloud KMS.

# vault-config.hcl
storage "raft" {
  path    = "/opt/vault/data"
  node_id = "vault-node-1"

  retry_join {
    leader_api_addr = "https://vault-node-2.internal:8200"
  }
  retry_join {
    leader_api_addr = "https://vault-node-3.internal:8200"
  }
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_cert_file = "/opt/vault/tls/vault.crt"
  tls_key_file  = "/opt/vault/tls/vault.key"
}

seal "awskms" {
  region     = "us-east-1"
  kms_key_id = "alias/vault-unseal-key"
}

api_addr      = "https://vault-node-1.internal:8200"
cluster_addr  = "https://vault-node-1.internal:8201"

telemetry {
  prometheus_retention_time = "30s"
  disable_hostname         = true
}

# Initialize Vault
vault operator init -key-shares=5 -key-threshold=3

# Enable audit logging
vault audit enable file file_path=/var/log/vault/audit.log

# Enable syslog audit for SIEM integration
vault audit enable syslog tag="vault" facility="AUTH"

Step 2: Configure Authentication Methods

Enable authentication backends for human operators, applications, and CI/CD pipelines. Use AppRole for machine authentication and OIDC for human access.