Hashicorp Vault Dynamic Secrets Demo

🔥 If you're interested in a step-by-step course to learn the basics of Vault, check this course out: HashiCorp Vault 101 - Certified Vault Associate ► https://bit.ly/hc-vault101 In this video, we talk about Hashicorp's Vault tool and how it can generate ephemeral dynamic secrets for a MongoDB. Agenda ● Intro to Vault ● Why Dynamic Secrets? ● Use Case ● Demo ● Next Steps ● Q & A What is a Secret? Anything that allows you to authenticate into a system or authorizes you to do something on that system Examples: ● Usernames and passwords ● DB creds ● API tokens ● TLS certs How to Manage Secrets The challenge is how to manage these secrets ● Who has access? ● Who has been using them? ● How can we periodically rotate them? Challenge 1: Secrets Sprawl Today secrets end up everywhere ● In source code in plain text ● In config mgmt (chef, puppet, ansible) in plain text ● In VCS (github, gitlab, bitbucket) Vault’s Solution 1: Centralization ● Centralize everything ● Encrypt at rest and in transit (between vault and clients) ● ACL (fine-grained access) ● Audit trail Challenge 2: Apps don’t keep secrets Applications do a terrible job keeping secrets ● Show up in stdout and may ship to logging tools (Splunk) ● In diagnostic output traceback exception or in an error report ● Sent to external monitoring systems Vault’s Solution 2: Dynamic Secrets ● Ephemeral instead of long-lived (30 days for example) ● Unique to each client ● Better revocation story (no outage) Challenge 3: Cryptography is hard How could apps store their own data at rest? ● Vault to manage secrets not confidential data ● Store encryption keys in Vault for apps to use in cryptography ● Easy to get cryptography wrong leading to compromises Vault’s Solution 3: Encryption as a Service ● Named Keys (ex: CC, SIN, PII) ● High-level APIs for Cryptography (ex: encrypt, sign, verify) ○ Example: HMAC(CC, …) ● Offload key management (key lifecycle) ○ Key versioning ○ Key rotation ○ Key decommissioning Vault’s Solutions Summary ● Secrets Sprawl: Centralization ● Apps not keeping secrets: Dynamic Secrets ● Difficult Cryptography: Encryption as a Service Use Case: DB Dynamic Secrets Demo Steps ● Web-blog app using environment variables ○ Hard-coded MongoDB username and password ○ The username and password are static and don’t expire ● Web-blog app using Vault’s dynamic secrets ○ MongoDB username and password are generated by Vault dynamically and passed to the app ○ The username and password expire every 10 seconds and get renewed ▬▬▬▬▬▬▬▬▬ Courses 🎓 ▬▬▬▬▬▬▬▬ TeKanAid Academy ► https://tekanaid.com/courses ▬▬▬▬▬▬▬▬ Useful Links 🛠 ▬▬▬▬▬▬▬ Get the code ► https://tekanaid.com/posts/webblog-ap... ▬▬▬▬ 🎓 FREE 7-Day Platform Engineering Crash Course ▬▬▬▬ One email a day for 7 days. Real tools, real CLI commands, hands-on labs. Day 1: What is Platform Engineering (the role, the market, why every large org is building a PE team) Day 2: Infrastructure as Code with Terraform Day 3: Containers and Kubernetes Day 4: Policy as Code (OPA + Sentinel) Day 5: CI/CD and GitOps (GitHub Actions + ArgoCD) Day 6: Observability and Security Day 7: Building Your Internal Developer Platform with Backstage + your 6-month career roadmap 👉 Sign up free: https://tekanaid.com/platform-enginee... ▬▬▬▬▬▬▬▬ 🛠️ Recommended Tools ▬▬▬▬▬▬▬▬ Cloud hosting, infra, and tooling I recommend for AI Platform Engineering. Includes affiliate links that help fund TeKanAid Academy at no cost to you. 👉 https://tekanaid.com/recommended-tools ▬▬▬▬▬▬▬▬ Connect 👋 ▬▬▬▬▬▬▬▬▬ Website ► https://tekanaid.com Facebook Page ►   / tekanaid   Don't forget to subscribe ► https://bit.ly/TeKanAid_YouTube_Subsc... MEDIUM ►   / sam-gabrail   TWITTER TeKanAid ► https://x.com/tekanaid TWITTER Sam ► https://x.com/Sam_Gabrail LINKEDIN TeKanAid ►   / tekanaid   LINKEDIN Sam ►   / samgabrail