Back to all tools
HashiCorp Vault
Secure, store, and tightly control access to tokens, passwords, and certificates.
0Free-Limited
Security Secrets Management
Overview
A tool for securely storing and accessing secrets such as tokens, passwords, certificates, and encryption keys.
Key Features
- Dynamic secrets — generate short-lived credentials on demand for AWS, databases, and more
- All secrets have a TTL and are automatically revoked on expiry
- Multiple auth methods: Kubernetes, AWS IAM, LDAP, GitHub, and AppRole
- Transit secrets engine for encryption-as-a-service
- PKI secrets engine for automated internal TLS certificate management
- Detailed audit log for every secret access and policy change
Real-World Workflows
Dynamic database credentials for microservices
- 1Configure Vault's database secrets engine with a PostgreSQL connection
- 2Define a role with a SQL template for creating temporary users
- 3Application authenticates to Vault using its Kubernetes service account
- 4Vault issues a unique username and password with a 1-hour TTL
- 5Credentials are automatically revoked when the TTL expires
Injecting secrets into Kubernetes pods
- 1Install the Vault Agent Injector via Helm into the cluster
- 2Annotate the pod spec with vault.hashicorp.com/agent-inject-secret annotations
- 3Vault Agent sidecar authenticates and writes secrets to a shared in-memory volume
- 4Application reads secrets from /vault/secrets/ at runtime without any SDK
- 5Secrets are automatically refreshed before the lease expires
Getting Started
# Run Vault in dev mode: docker run --cap-add=IPC_LOCK \ -e VAULT_DEV_ROOT_TOKEN_ID=root \ -p 8200:8200 hashicorp/vault export VAULT_ADDR='http://127.0.0.1:8200' vault status
Compare Alternatives
See how HashiCorp Vault stacks up against similar tools.