This document discusses using HashiCorp Vault for secrets management. It begins with an introduction and agenda. It then covers the problems with storing secrets in code or cloud services. Next, it provides an overview of HashiCorp Vault, highlighting that it allows for encrypted secrets storage and lifecycle management. It also supports identity-based access controls and dynamic secrets. The document concludes with a demo summary emphasizing best practices like rotating keys often, using dynamic secrets, restricting access with policies, and integrating OAuth.

1. Securing AWS Accounts
with HashiCorp Vault
Shrivatsa Upadhye
Cloud Developer Advocate (VMware)
Feb 2020

2. 2
whoami (Who am I?)
• Cloud Developer Advocate @VMWare
• Focused on Public Cloud and Application security
• Part of CloudJourneyIO team
• Love Cars, Pizza and Netflix
Follow me on Twitter/Medium/GitHub/LinkedIn : @ishrivatsa

3. 3
Agenda
• Problem Statement
• Why do we need Secrets Management?
• Overview - HashiCorp Vault
• What are Dynamic Secrets?
• Demo

4. 4
Problem
Statement
Access and Secret keys are used in dev and prod
environments for deploying applications
Restricting privileged access to cloud services is
crucial
Revoke the access and secret keys when not used or
compromised
Allow usage of credentials only for limited time
Audit and log the usage of credential access
Maintaining consistent user experience for managing
secrets lifecycle across different environment

5. 5
Why do we
need Secrets
Management
?
• 1. Adoption of Microservices architecture means that
these services would communicate with each other and
external services by using API keys and other secrets
(database passwords), etc
• 2. Hardcoding of secrets within an application is NOT a
good practice as there is the risk of these secrets being
exposed on git repositories.
• 3. Hackers usually tend to exploit unencrypted secrets
and keys. This is one of the main reasons for data
breaches.
• 4. Teams working in shared public cloud
environments, need strict access controls on who can
access what portion of the infrastructure. This will allow
for centralized secrets management.

6. 6
Hashi Vault
SELF HOSTED
AND OPERATED
FREEMIUM
MODEL –
OPENSOURCE
AND ENTERPRISE
VERSION
AVAILABLE
ENCRYPTED
SECRETS
LIFECYCLE
MANAGEMENT
OF SECRETS –
STORE, ROTATE,
REVOKE, EXPIRE
IDENTITY BASED
ACCESS TO
SECRETS
SUPPORTS
POLICIES TO
DEFINE
PERMISSIONS
FOR
USERS/SYSTEMS
CLOUD
AGNOSTIC –
WORKS WITH
AWS, AZURE AND
GOOGLE CLOUD

7. 7
AWS Secrets Manager HashiCorp Vault
Fully Managed Self Hosted and Operated
Service Seamless secrets rotation for native services like
RDS, RedShift and DocumentDB (Might need Lambda for
some key rotation)
Secrets Rotation must be done with scripts
No lease periods for secrets Duration can be set for how long the access to secrets
are allowed
Coupled to AWS ecosystem Cloud Agnostic i.e. Works with AWS, Azure, and GCP
Limited (MariaDB, MySQL, Postgres) or no native
integration with Mongo and Kubernetes
Integrations for various opensource and licensed
databases like Influx, Mongo, Hana as well as Kubernetes
secrets
Paid service - Charged for API calls as well as storage for
every secret
Freemium model - They have an Opensource version as
well as Enterprise version
AWS Secrets Manager vs Hashi Vault

8. 8
Dynamic Secrets
• Dynamic secrets, on the other hand, are not stored until the user or client initiates a read or GET call.
• Why dynamic secrets ?
• Leaky Applications - Dynamic secrets minimize the impact of leaky applications by ensuring credentials are
ephemeral.
• Audit Trail - Unique credentials per client makes it much easier to do forensics and understand the source of
compromise.
• Key Rotation - By attaching a lease to secrets and enforcing a maximum time to live, secrets are being
automatically rotated.
• Revocation - This makes it possible to revoke specific leases in the case of a compromise. Unique credentials
limits the blast radius of a revocation, preventing full-service outages

9. 9
Demo

10. 10
Summary
• Rotate keys often
• Leverage Dynamic Secrets
• Set vault policies to restrict access to credentials
• Use OAuth integration to improve user experience

11. 11
Thank You
@iShrivatsa