Skip to main content

HashiCorp Vault — Secrets Management Guide

Centralize secrets storage, enforce access policies, generate dynamic credentials, and encrypt data at rest — all with full audit logging of every access.

✓ Dynamic secrets (auto-expiring) ✓ PKI / TLS certificate authority ✓ Transit encryption-as-a-service ✓ AppRole / Kubernetes / AWS IAM auth

What is HashiCorp Vault?

HashiCorp Vault is an identity-based secrets management platform designed to solve the hardest security problems in modern infrastructure: how do you store secrets securely, who should have access, how do you rotate credentials, and how do you know who accessed what? Released in 2015, Vault has become the de facto standard for secrets management in cloud-native environments, used by thousands of organizations from startups to Fortune 500 enterprises.

Vault organizes its capabilities into secrets engines (plugins that store or generate secrets — KV, database, AWS, PKI, transit) and auth methods (plugins that authenticate callers — AppRole, Kubernetes, AWS IAM, LDAP, JWT). Every request to Vault is authenticated and authorization is checked against policies written in HCL. Every access is recorded in an audit log. Secrets have leases that limit how long they are valid, and Vault can automatically renew or revoke them.

Key Features

Getting Started: CLI Basics

# Start dev server (in-memory, DO NOT use in production)
vault server -dev

export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='root'   # shown after vault server -dev starts

# Check status
vault status

# Enable KV v2 secrets engine at path 'secret/'
vault secrets enable -path=secret kv-v2

# Write and read secrets
vault kv put secret/myapp/config db_host=postgres db_port=5432
vault kv get secret/myapp/config
vault kv get -format=json secret/myapp/config | jq '.data.data'

# See all versions
vault kv metadata get secret/myapp/config

# Delete a specific version
vault kv delete -versions=1 secret/myapp/config

Dynamic Database Credentials

# Enable the database secrets engine
vault secrets enable database

# Configure a PostgreSQL connection
vault write database/config/my-postgres \
  plugin_name=postgresql-database-plugin \
  connection_url="postgresql://{{username}}:{{password}}@postgres:5432/mydb" \
  allowed_roles="my-app-role" \
  username="vault_admin" \
  password="vault_admin_password"

# Create a role that generates 1-hour database credentials
vault write database/roles/my-app-role \
  db_name=my-postgres \
  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
  default_ttl="1h" \
  max_ttl="24h"

# Request credentials (new unique user each time)
vault read database/creds/my-app-role
# Key                Value
# ---                -----
# username           v-token-my-app-rol-AbC123xyz
# password           A1B2C3D4E5F6G7H8
# lease_duration     1h

AppRole Authentication

# Enable AppRole auth
vault auth enable approle

# Write a policy for the application
vault policy write my-app-policy - < 
Vault vs Secrets Management Alternatives
 
 
  
 Feature HashiCorp Vault AWS Secrets Manager Azure Key Vault Doppler 1Password Secrets 
   
 Dynamic secrets Yes (core feature) Limited (RDS rotation) No No No 
 
 Multi-cloud Yes AWS only Azure only Yes Yes 
 
 PKI / TLS CA Yes ACM (separate) Yes (Managed HSM) No No 
 
 Self-hosted Yes (OSS) No (managed) No (managed) No (SaaS) No (SaaS) 
 
 Audit logging Comprehensive CloudTrail Azure Monitor Activity log Activity log 
 
 Complexity High (self-managed) Low (fully managed) Low (fully managed) Low (SaaS) Low (SaaS) 
  
 
 
Use Cases
 
     
  • Eliminating hardcoded database passwords — dynamic credentials rotate automatically every hour
    •  
  • Internal certificate authority — issue short-lived TLS certs to microservices via the PKI engine
    •  
  • Encryption-as-a-service — encrypt PII before storing in databases using the Transit engine
    •  
  • CI/CD pipeline secrets — Jenkins, GitHub Actions, and GitLab CI authenticate via AppRole or JWT
    •  
  • Kubernetes secrets injection — Vault Agent sidecar or CSI driver injects secrets into pods
    •  
  • Compliance and auditing — every secret access logged with timestamp, caller identity, and path
    •  
 
Pros and Cons
 
 
 
Pros
 
     
  • ✓ Dynamic secrets are a game-changer for security posture
    •  
  • ✓ Multi-cloud, multi-platform — works everywhere
    •  
  • ✓ Full-featured PKI engine for internal TLS
    •  
  • ✓ Transit engine for application-layer encryption
    •  
  • ✓ Open source, self-hosted, no vendor lock-in
    •  
  • ✓ Comprehensive audit logging for compliance
    •  
 
 
 
Cons
 
     
  • ✗ Complex to operate — unsealing, HA setup, backup procedures
    •  
  • ✗ Requires dedicated infrastructure and operational expertise
    •  
  • ✗ Vault Enterprise needed for performance replication (expensive)
    •  
  • ✗ Policy language (HCL paths) has a learning curve
    •  
  • ✗ Application integration requires SDK or Vault Agent setup
    •  
  • ✗ Overkill for small teams who just need static secret storage
    •  
 
 
  
Frequently Asked Questions
What is HashiCorp Vault and what problems does it solve?▼
Vault is a secrets management platform that centralizes storage, access control, and auditing of sensitive data: API keys, database credentials, TLS certificates, encryption keys, and passwords. The core problem it solves is 'secret sprawl' — credentials hardcoded in config files, environment variables scattered across servers, and no audit trail of who accessed what. Vault provides a single source of truth for secrets with fine-grained policies, time-limited leases, automatic rotation, and comprehensive audit logging of every secret access.
What are dynamic secrets and why are they safer than static ones?▼
Dynamic secrets are generated on-demand and automatically expire after a configurable lease period. For example, when an application requests database credentials from Vault's database secrets engine, Vault creates a new PostgreSQL user with a random password and a 1-hour TTL. After the TTL expires, Vault automatically revokes that credential. This means leaked credentials expire on their own, you always know which application used which credentials (each request gets unique creds), and you never have long-lived passwords that accumulate over time.
What authentication methods does Vault support?▼
Vault supports many auth methods: AppRole (machine-to-machine, CI/CD pipelines), Kubernetes (pods authenticate using ServiceAccount JWTs), AWS IAM (EC2 instances or Lambda functions authenticate using AWS credentials), LDAP, GitHub, JWT/OIDC (for cloud platforms), TLS certificates, and userpass (for humans). In production, AppRole and Kubernetes are the most common for service authentication. Each auth method issues a Vault token with policies attached. The principle of least privilege applies: each service gets only the policies it needs.
What is the Transit secrets engine?▼
The Transit engine turns Vault into an 'encryption-as-a-service' API. Instead of managing encryption keys in your application code, you send plaintext to Vault's /transit/encrypt endpoint and receive ciphertext back. The encryption key never leaves Vault. To decrypt, send the ciphertext to /transit/decrypt. This pattern is ideal for encrypting PII or PCI data before storing it in a database — your application never handles raw keys, key rotation is centralized in Vault, and you get audit logs of every encrypt/decrypt operation.
How does Vault handle high availability and disaster recovery?▼
Vault supports multiple storage backends for HA: Integrated Storage (Raft consensus, built-in, recommended for new deployments), Consul, etcd, and cloud storage (DynamoDB, Azure Blob, GCS). In Raft mode, you run 3 or 5 Vault nodes — one is the leader and the others are standbys that automatically promote if the leader fails. For DR, Vault Enterprise supports Performance Replication (read-only replica clusters in other regions) and DR Replication. OSS Vault requires you to manage backups via vault operator raft snapshot and test restore procedures.
What is Vault Agent and when should I use it?▼
Vault Agent is a client-side daemon that handles authentication and secret retrieval on behalf of your application. It runs alongside your application (as a sidecar or systemd service), authenticates to Vault automatically, renews tokens, fetches secrets, renders them into template files, and restarts your application when secrets change. This means your application doesn't need the Vault SDK — it just reads a file or environment variable that Vault Agent keeps fresh. Use Vault Agent for legacy applications, simple services, or any scenario where you want to decouple Vault integration from the application code.
 
 Share this tool:  
X / Twitter
  
LinkedIn
 
   
 
  ✓ 60,000+ developers use DevPlaybook
  ★★★★★ 4.8 / 5 on Gumroad   ✓
MIT licensed · Instant download
  ✓
No login required
 
 
 
 
 
Related Products
 on Gumroad 
 
  
 🚀 $19 
 
Premium Workflow Pack
 
Production-grade workflows, architecture guides, and deployment scripts for teams that ship. 10 advanced CI/CD workflows (blue-green, canary, E2E, security), 5 architecture deep-dives, code review checklist, PR process guide, and 5 battle-tested Bash deployment scripts.
 
Buy on Gumroad →
  
 ⚙️ $19 
 
GitHub Actions CI/CD Templates Pack
 
12 production-ready GitHub Actions workflow templates covering Node.js, Python, Docker, multi-environment deployments, security scanning, and auto-changelog. Copy, paste, ship.
 
Buy on Gumroad →
  
 ⚡ $29 
 
Developer Productivity Bundle
 
Stop rebuilding the same setup every project. 51 VSCode snippets, 40 Git aliases, 5 Docker Compose stacks, 5 GitHub Actions workflows, 5 README templates, and a dotfiles kit. Set up a professional dev environment in under an hour.
 
Buy on Gumroad →
  
  
You Might Also Need
 
  
Vault Policy Generator
 
Generate HashiCorp Vault HCL policies from path and capabilities form. Build least-privilege Vault policies for secrets access control.
 
Open free tool →
  
HTTP Security Headers Generator
 
Generate HTTP security headers configuration for nginx and Apache. Configure HSTS, CSP, X-Frame-Options, Referrer-Policy, and more with toggle switches. Copy ready-to-use configs.
 
Open free tool →
  
HTTP Security Headers Checker
 
Paste HTTP response headers and get a checklist of security headers present or missing. Checks CSP, HSTS, X-Frame-Options, and more.
 
Open free tool →
  
 
More Free Tools
 
  Vault Policy Generator  HTTP Security Headers Generator  HTTP Security Headers Checker  Content Security Policy Builder  Nomad Job Spec Builder  HTTP Header Inspector  Prompt Injection Tester  GCP Service Account Key Auditor  HTTP Headers Analyzer  AI System Guardian  Docker Compose Generator  .htaccess Generator  nginx Config Generator  Password Strength Checker  Dockerfile Generator  CSP Header Builder  Terraform Variable Validator  GitHub Actions YAML Linter  AWS IAM Policy Validator  HTTP Cookie Parser  SBOM Generator  CI/CD Pipeline Generator  HTTP Header Analyzer  Dockerfile Linter  Packer Machine Image Builder Guide  HashiCorp Consul Service Mesh Guide  HashiCorp Vault  Kubernetes Resource Calculator  Docker Layer Optimizer  Password Strength Analyzer  
 
 
Related Articles
 
  
Apr 2, 2026 · 13 min read
 
DevSecOps Tools Checklist 2026: 20 Essential Tools for Shift-Left Security
 
Complete DevSecOps tools checklist for 2026. 20 essential SAST, DAST, SCA, secrets scanning, and container security tools with free/open-source options.
  
Mar 28, 2026 · 18 min read
 
Complete Guide to HTTP Security Headers: CSP, HSTS, and Modern Browser Security 2026
 
Master HTTP security headers in 2026: Content-Security-Policy configuration, HSTS preloading, Permissions-Policy, COEP/COOP for cross-origin isolation, and real-world configs for nginx, Apache, and Next.js.
  
Invalid Date · 12 min read
 
Kubernetes Security Hardening: 15 Essential Practices
 
A comprehensive guide to Kubernetes security hardening—RBAC, Pod Security Standards, network policies, secrets management, and container scanning with real examples.
  
Apr 2, 2026 · 12 min read
 
Zero-Trust Architecture Implementation Guide for Developers 2026
 
Practical zero-trust architecture guide for developers: identity verification, network segmentation, service mesh, mTLS, and step-by-step implementation roadmap.
  
Mar 28, 2026 · 17 min read
 
Zero Trust Architecture: A Practical Guide for Web Developers 2026
 
Implement Zero Trust for web applications: mTLS between services, SPIFFE/SPIRE identity, service mesh security (Istio/Linkerd), token-based auth patterns, and BeyondCorp-style network access.
  
 
 
  
 
 
 
Enjoying this tool? Get more like it.
 
Weekly developer tool guides, productivity playbooks & AI tricks. Free. No spam.
 
 
  
 
 
  
 
 
 
 DevPlaybook Pro 7 days free 
 
Unlock AI-Powered Dev Tools
 
     
  • ⚡ AI Code Review, Doc Generator & SQL Builder
    •  
  • ⚡ All premium templates & early access
    •  
  • ⚡ Member discounts on Gumroad products
    •  
 
 
 
Start Free Trial →
 
$9/mo after trial · Cancel anytime
 
 
 
  
 
Want the full toolkit?
 
Get DevPlaybook Pro
 

Every template, guide, boilerplate, and automation script in one bundle.
    13 premium products — grab them all at once and save big.

 
 $79 
 $241 separately Save $162 (67% off) 
 
 
Get DevPlaybook Pro — $79 →
 
MIT licensed · Instant download · No subscription
 See what's included → Browse all deals →