We set up an ssh cert signing server using Hashicorp Vault [1] so we didn't have to keep rotating keys across a fleet of boxes we couldn't always reach. It was

We set up an ssh cert signing server using Hashicorp Vault [1] so we didn't have to keep rotating keys across a fleet of boxes we couldn't always reach. It was cool but it made me nervous to centralize something like that. Cert sigantures expired after 30 min so leaks were not a problem. It was backed by DynamoDB and the keys were in memory so everytime the containers rebooted someone would have to manually unseal before SSH would work again. [1] - https://www.hashicorp.com/blog/managing-ssh-access-at-scale-with-hashicorp-vault https://www.hashicorp.com/blog/managing-ssh-access-at-scale-...