Vault Engines: Static vs. Dynamic Secrets

Once authenticated and holding a valid token, what can you actually retrieve? Vault organizes its capabilities into Secrets Engines — pluggable backends that handle different types of secrets differently.

1. KV (Key-Value) Engine: Static Secrets

The KV engine is the simplest: it is an encrypted key-value store. You write data in, you read the exact same data back out — a vault kv put call to store a path full of key-value pairs, a matching vault kv get to read them back. Think of it as a secure, encrypted spreadsheet.

KV v2 (the current version) also supports versioning — every write creates a new version, and you can roll back to previous versions. This is invaluable when a secret rotation goes wrong.

The limitation: The secret is static. If an attacker steals sk_live_abc123, they can use it indefinitely until you manually detect the breach, rotate the key, and update every system using it. Manual rotation is error-prone and often delayed.

2. Dynamic Secrets Engines: The Magic Feature

Dynamic secrets are generated just-in-time, on demand, for a specific requester. They do not exist until someone asks for them, and they automatically expire and are revoked after a configured TTL.

The Database Engine — A Concrete Example:

1. Your web application authenticates to Vault and requests database credentials.
2. Vault does not look up a stored username/password. Instead, Vault connects to your PostgreSQL database using a privileged "root" credential it holds internally.
3. Vault executes a SQL statement to create a brand-new, uniquely-named temporary user with specific permissions and a 30-minute lifespan:
   sql CREATE ROLE "v-app-abc123" WITH LOGIN PASSWORD 'generated-password' VALID UNTIL '2024-01-01 12:30:00'; GRANT SELECT, INSERT ON TABLE orders TO "v-app-abc123";
4. Vault returns v-app-abc123 and the generated password to your application.
5. After 30 minutes, Vault automatically connects to PostgreSQL and executes DROP ROLE "v-app-abc123".

Why this is transformative: If an attacker steals these credentials, they have a 30-minute window at most. There is no long-lived password to steal. Every application instance gets unique credentials, so you can trace exactly which instance was compromised. Rotation is automatic — no human intervention required.

Other dynamic engines include:
* AWS Engine: Generates temporary AWS IAM credentials (access key + secret key) with specific permissions.
* PKI Engine: Issues short-lived TLS certificates on demand, enabling certificate lifetimes measured in hours rather than years.
* SSH Engine: Issues signed SSH certificates for server access, eliminating the need to distribute and manage SSH public keys.