4 ms·

If you're thinking of HashiCorp Vault as a platform that is solely there for secure storage of static secrets (i.e. basically a secure key/value store), then yo

If you're thinking of HashiCorp Vault as a platform that is solely there for secure storage of static secrets (i.e. basically a secure key/value store), then you probably would think it is over-hyped. The power of Vault is in the integrations and the unification of authorization policies across those different integrations. "I need a way to allow my different AWS accounts to issue TLS certificates within particular namespaces of a common CA" - Vault can do that. "I am managing service identity using mTLS at the moment, but now I need to get short-lived SSH keys for those service identities" - Vault can do that too. "I need to issue credentials that allow access to AWS and GCP IAM roles to my on-premise application which has a JWT" - you guessed it, Vault can do that.

stevekemp 7y ago
Agreed. Vault is awesome, dynamically creating TLS certificates for VPN-usage, creating new MySQL usernames/passwords, with limited lifecycles, etc. Most of the love I have for it is from things above and beyond mere static-secrets. It also has to be said that KMS will get expensive quickly too. Though it is probably fair to say that a three node vault installation with dynodb backend won't be so cheap it'll be rock-solid and I think it could be documented within an hour - for a develop to use it at least. Edit: I'd never heard of SOPS, apart from the many open issues and pull-requests making it look a little swamped, it seems like a nice tool. Especially given that it can work with GPG-keys.