HashiCorp Vault is the most widely adopted open-source tool for managing secrets. Think of it as a digital bank vault for your infrastructure — one that keeps detailed records of every person who ever opened it, what they took out, and when they put it back.
Core Principles
Vault is designed around four non-negotiable security principles:
-
Encryption is Paramount: All data managed by Vault is encrypted before it is ever written to persistent storage (a disk, a database backend like Consul or PostgreSQL). Even if someone steals the physical hard drive Vault writes to, they get only ciphertext — meaningless without the encryption key.
-
Identity-Based Access: Vault does not care about network location (IP addresses can be spoofed). It cares about identity. Before you can retrieve a secret, you must prove who you are (Authentication), and then Vault checks whether you are permitted to access that specific secret (Authorization via Policies).
-
Least Privilege: Vault's policy system is deny-by-default. A freshly created identity has access to nothing. You explicitly grant access to specific paths and specific operations (read, write, list, delete). An application that only needs to read database credentials cannot accidentally (or maliciously) read TLS certificates.
-
Auditing: Every single interaction — login attempts, secret reads, policy changes, token renewals — is written to an audit log. You always know who accessed what, from where, and when. This is essential for compliance (SOC 2, PCI-DSS, HIPAA) and incident response.
Vault's Storage Backend
Vault itself does not store data in its own proprietary database. It writes encrypted blobs to a pluggable storage backend — commonly HashiCorp Consul, a PostgreSQL database, or a cloud object store like S3. This means Vault's storage can be highly available and replicated, but the backend never sees plaintext data. Even a compromised storage backend reveals nothing without Vault's encryption key.