HashiCorp Vault — Secrets Management & Encryption Platform

What it is

HashiCorp Vault is a secrets management and encryption platform that centralizes the storage and access of sensitive data: API keys, database credentials, TLS certificates, and encryption keys. Vault provides dynamic secrets (short-lived credentials generated on demand), encryption as a service, and fine-grained access control policies. It integrates with cloud providers, databases, and identity systems.

Vault targets security teams, platform engineers, and DevOps organizations that need to eliminate hard-coded secrets, enforce credential rotation, and maintain an audit log of all secret access.

How it saves time or tokens

Without Vault, teams scatter secrets across environment variables, config files, and CI/CD pipelines with no central audit trail. Vault consolidates all secrets into a single source of truth with automatic rotation. Dynamic secrets for databases mean each application instance gets unique, short-lived credentials that auto-expire, eliminating shared long-lived passwords. The API-first design integrates with any automation tool.

How to use

1. Start Vault in dev mode (not for production):

docker run -d --name vault --cap-add IPC_LOCK \
  -p 8200:8200 \
  -e VAULT_DEV_ROOT_TOKEN_ID=my-root-token \
  -e VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200 \
  hashicorp/vault

1. Set environment variables and store a secret:

export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='my-root-token'
vault kv put secret/myapp db_password='s3cret'

1. Retrieve the secret:

vault kv get secret/myapp

Example

Dynamic database credentials with Vault:

# Enable the database secrets engine
vault secrets enable database

# Configure a PostgreSQL connection
vault write database/config/mydb \
  plugin_name=postgresql-database-plugin \
  connection_url='postgresql://{{username}}:{{password}}@db:5432/mydb' \
  allowed_roles='readonly' \
  username='vault_admin' \
  password='admin_pass'

# Create a role with a 1-hour TTL
vault write database/roles/readonly \
  db_name=mydb \
  creation_statements="CREATE ROLE \"{{name}}\" LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  default_ttl=1h max_ttl=24h

# Get dynamic credentials
vault read database/creds/readonly

Related on TokRepo

• AI Tools for Security — security tools and vulnerability management
• AI Tools for DevOps — infrastructure automation and configuration management

Common pitfalls

• Dev mode stores all data in memory and auto-unseals; never use it for production workloads
• Vault's unseal process requires multiple key shares; plan your key management strategy before deployment
• Policy syntax errors fail silently in some cases; always test policies with vault policy fmt before applying