Vault provides secure multi-tenancy by allowing the creation of namespaces that isolate "Vaults within a Vault". Each namespace can have independent authentication methods, secret engines, policies, identities and access management. Vault also enables API-driven encryption through secret engines like Transit and unified identities across multiple environments through its identity system. These capabilities allow Vault to securely store, restrict access to, and manage encryption of secrets and keys for multi-tenant infrastructure.

1. Copyright © 2021 HashiCorp
Secure Multi-Tenancy with HashiCorp
Vault
Secure, store, and tightly control access to tokens, passwords, certificates,
encryption keys for protecting sensitive data, and other secrets in multi-tenant
infrastructure.
SEPT 2021

2. Vault
Workflow
Clients
Auth Provider
Policy
Secret Engines
Login
and
Generate Token
Authentication
Attach the
policy
Secret
Management
Using the Token
Dynamic Secret
Audit
Vault tightly controls access to secrets and
encryption keys by authenticating against
trusted sources of identity such as Active
Directory, LDAP, and cloud identity platforms.
Vault enables fine grained authorization of
which users and applications are permitted
access to secrets and keys.

3. Copyright © 2021 HashiCorp
The challenges of Multi tenancy
How do i maintain separation but allow scalability
March 2021

4. Copyright © 2018 HashiCorp ⁄
▪ Database management Example
– Who has the passwords?
– Which Cloud?
– How many do I have?
SECRETS MANAGEMENT
What type of tenancy
Single Multi-tenant

5. Copyright © 2018 HashiCorp ⁄
How do you manage your data end to end encryption?

6. Copyright © 2021 HashiCorp
The Approach
Tooling that allows to achieve secure multi tenancy
March 2021

7. Namespaces
Namespaces for management,
secure multi tenancy
Create isolated “Vaults within a Vault” that allow for parent
admins to manage configurations but permit teams to
manage their own policies, secrets, and identities.
ENTERPRISE
▪ Allow teams to self-manage segmented Vault environments
with their own auth methods, secret engines, and policy and
identity infrastructures
▪ Isolate tenant environments for security, compliance
▪ Enforce organizational compliance across isolated teams

8. API-driven encryption
With the Transit secret engine, Vault can enable users
and applications to perform cryptographic workloads
without a key management infrastructure.
▪ Automate encryption, decryption, and cryptographic hashing
and signing without deploying new infrastructure.
▪ Quickly create and manage keys (including rotation) without
deploying complex key management servers.
▪ Support AES 256, RSA (2048 and 4096), ECDSA-p256,
ed25519, chacha20-poly1305, and more.
Use the Transit secret engine
to handle encryption, decryption,
and cryptographic signing.

9. Unified identity
With Vault’s unified identity system, Vault can match one
identity across cloud environments, applications, etc.
▪ One logical identity can be recognized with multiple
aliases from separate cloud, on-prem, app environments.
▪ Use Identity Groups to simplify RBAC logic.
Unified Identity: one identity across
multiple environments.

10. Create a namespace dedicated to each team, organization, or app where they can perform all necessary tasks
within their tenant namespace. Each namespace can have its own:
Policies, Auth Methods, Secrets Engines ,Tokens and a Identity entities and groups
Example