HashiCorp Vault
Secrets management, encryption as a service, and identity-based access platform with dynamic credentials, PKI, and audit logging.
Technical Architecture & Overview
HashiCorp Vault is a tool for secrets management, encryption as a service, and privileged access management. It centralizes storage and tight access control for tokens, passwords, certificates, and encryption keys, and provides a dynamic secrets engine, PKI, and data encryption. Vault is source-available under the Business Source License 1.1 and is offered as Vault Community and Vault Enterprise. HashiCorp, now an IBM company, maintains the project. The license changed from MPL-2.0 to BUSL-1.1 in August 2023.
Targeted Technical Use Cases
Centralized secrets management, dynamic database credentials, automated certificate rotation, and encryption for applications.
Evaluation & Trade-offs
Core Strengths
- +Broad secrets engine ecosystem covering databases, PKI, transit encryption, and cloud providers.
- +Identity-based access controls with multiple authentication methods.
- +Dynamic secrets reduce credential exposure by issuing short-lived, auto-revoked credentials.
Trade-Offs & Limitations
- -BUSL-1.1 license restricts redistribution and competitive use compared to the previous MPL-2.0.
- -High-availability deployments require operational expertise for clustering and storage backends.
- -Requires careful backup, unseal, and recovery key management procedures.
Defensive Security Application
Store application secrets in Vault instead of hard-coded values, use dynamic secrets for short-lived credentials, and enable audit logging to track all access.
Frequently Asked Questions
What is HashiCorp Vault?→
HashiCorp Vault is a tool for secrets management, encryption as a service, and privileged access management. It centralizes storage and tight access control for tokens, passwords, certificates, and encryption keys, and provides a dynamic secrets engine, PKI, and data encryption. Vault is source-available under the Business Source License 1.1 and is offered as Vault Community and Vault Enterprise. HashiCorp, now an IBM company, maintains the project. The license changed from MPL-2.0 to BUSL-1.1 in August 2023.
What is HashiCorp Vault used for?→
Centralized secrets management, dynamic database credentials, automated certificate rotation, and encryption for applications.
What are the strengths of HashiCorp Vault?→
- +Broad secrets engine ecosystem covering databases, PKI, transit encryption, and cloud providers.
- +Identity-based access controls with multiple authentication methods.
- +Dynamic secrets reduce credential exposure by issuing short-lived, auto-revoked credentials.
What are the limitations of HashiCorp Vault?→
- +BUSL-1.1 license restricts redistribution and competitive use compared to the previous MPL-2.0.
- +High-availability deployments require operational expertise for clustering and storage backends.
- +Requires careful backup, unseal, and recovery key management procedures.
How is HashiCorp Vault used defensively?→
Store application secrets in Vault instead of hard-coded values, use dynamic secrets for short-lived credentials, and enable audit logging to track all access.