GitHubDownload
Download

Secrets Management in Low Trust Networks

Centrally store, access, and deploy secrets across applications, systems, and infrastructure

Download Get Started

The Challenge

Secrets for applications and systems need to be centralized and static IP-based solutions don't scale in dynamic environments with frequently changing applications and machines

The Solution

Vault centrally manages and enforces access to secrets and systems based on trusted sources of application and user identity

Dan_McTeer_Adobe_HashiConf2017

Using Vault to Protect Adobe's Secrets and User Data Across Clouds and Datacenters

Securing secrets and application data is a complex task for globally distributed organizations. For Adobe, managing secrets for over 20 products across 100,000 hosts, four regions, and trillions of transactions annually requires a different approach altogether.

Read Case Study

Secret Management Features

Dynamic Secrets

Dynamically create, revoke, and rotate secrets programmatically

Secret Storage

Encrypt data while at rest, in the storage backend of your choice

  1. $ cat vault.config
  3. storage "consul" {
  4. address = "127.0.0.1:8500"
  5. path = "vault"
  6. }
  8. listener "tcp" {
  9. address = "127.0.0.1:8200"
  10. }
  12. telemetry {
  13. statsite_address = "127.0.0.1:8125"
  14. disable_hostname = true
  15. }

Secure Plugins

Improve the extensibility of Vault with pluggable secret backends

  • MySQL Logo
  • Cassandra Logo
  • Oracle Logo
  • Consul Logo
  • AWS Logo
  • MongoDB Logo
  • PostgreSQL Logo
  • Microsoft SQL Server Logo

Detailed Audit Logs

Detailed audit log of all client interaction (authentication, token creation, secret access & revocation)

  1. $ cat audit.log | jq {
  2. "time": "2018-08-27T13:17:11.609621226Z",
  3. "type": "response",
  4. "auth": {
  5. "client_token": "hmac-sha256:5c40f1e051ea75b83230a5bf16574090f697dfa22a78e437f12c1c9d226f45a5",
  6. "accessor": "hmac-sha256:f254a2d442f172f0b761c9fd028f599ad91861ed16ac3a1e8d96771fd920e862",
  7. "display_name": "token",
  8. "metadata": null,
  9. "entity_id": ""
  10. }
  11. }

Leasing & Revoking Secrets

Manage authorization and create time-based tokens for automatic revocation or manual revocation

  1. $ vault read database/creds/readonly
  3. Key Value
  4. --- -----
  5. lease_id database/creds/readonly/3e8174da-6ca0-143b-aa8c-4c238aa02809
  6. lease_duration 1h0m0s
  7. lease_renewable true
  8. password A1a-w2xv2zsq4r5ru940
  9. username v-token-readonly-48rt0t36sxp4wy81x8x1-1515627434
  10. [...]
  12. $ vault renew database/creds/readonly/3e8174da-6ca0-143b-aa8c-4c238aa02809
  14. Key Value
  15. --- -----
  16. lease_id database/creds/readonly/3e8174da-6ca0-143b-aa8c-4c238aa02809
  17. lease_duration 1h0m0s
  18. lease_renewable true
  19. $ vault lease revoke database/creds/readonly/3e8174da-6ca0-143b-aa8c-4c238aa02809

Ready to get started?

Download Explore Docs