HashiCorp Vault
Vault keeps secrets out of code and files. Applications authenticate, get a short-lived token and read only the paths their policy allows. It can also create dynamic database or cloud credentials that expire. On AWS the managed alternative is Secrets Manager.
Key concepts #
- Secrets engine: where secrets live, such as
kvordatabase. - Auth method: how a client proves who it is (token, AppRole, Kubernetes, AWS).
- Policy: the paths and capabilities a token has.
- Seal: Vault starts sealed and needs unseal keys.
Learn it #
Follow Install Vault with Docker and read Terraform secrets management.
Related tutorials
- Terraform & OpenTofu Tutorials
Install HashiCorp Vault with Docker: Secrets, Policies and Terraform
Run Vault in dev mode, store secrets in the KV engine, restrict access with policies and tokens, and read them from the CLI, curl and Terraform.
- Security
Checkov
Checkov is an open source static analysis tool that scans Terraform, Kubernetes and Dockerfile code for security and compliance misconfigurations.
Security
Trivy
Trivy is an open source security scanner that finds vulnerabilities, misconfigurations and secrets in container images, code and infrastructure files.