Dynamic credentials and secrets—meaning credentials that are automatically rotated over a reasonable period of time—are crucial to a strong security posture. Without them, an attacker could move around in your network for months or years with valid credentials. Frequently rotating credentials can be a major hassle, but HashiCorp Vault is changing that. In this solutions engineering hangout session, Thomas Kula, an SE at HashiCorp will demo how to use Vault to deliver dynamic database credentials in an easy, automated manner.

1. Securing Databases with Dynamic Credentials and Vault
Thomas Kula
Sr. Solutions Engineer
github.com/thomashashi/hashihang-dynamic-db-creds

2. Applications Stacks Are Changing
What used to work

3. Applications Stacks Are Changing
No longer scales

4. The Challenges
● Short-lived dynamic infrastructure shares long-lived static secrets
● A secrets problem with one instance is a problem for all instances
● Rolling out new secrets takes a long time - time you may not have
● Identifying the scope of problems is a challenge

5. The Solution: Dynamic Secrets
● Short-lived, per-instance credentials
● Secret lifetime matches instance lifetime
● A problem in a single instance affects only that instance
● Discovering the scope of problems is much easier

6. Securing Databases with Dynamic Credentials and Vault
DEMO

7. www.hashicorp.com
hello@hashicorp.com
Q & A

8. Securing Databases with Dynamic Credentials and Vault
Thomas Kula
Sr. Solutions Engineer
github.com/thomashashi/hashihang-dynamic-db-creds