HashiCorp Vault is a centralized secrets management platform that provides secure storage, access control, and auditing for sensitive data like passwords, API keys, certificates, and encryption keys.

Problems it solves:

• Secret sprawl: Eliminates hardcoded secrets in applications and configuration files
• Access control: Provides fine-grained policies for who can access what secrets
• Audit trail: Maintains detailed logs of all secret access and operations
• Secret rotation: Automates credential rotation to reduce exposure risk
• Encryption: Provides encryption-as-a-service for data protection

Example use case: Instead of storing database passwords in application config files, applications authenticate to Vault and retrieve credentials dynamically.

Static Secrets:

• Pre-existing secrets stored in Vault (like API keys, passwords)
• Values remain constant until manually updated
• Stored in Key-Value (KV) secret engines
• Example: Storing a third-party API key that doesn't change frequently

Dynamic Secrets:

• Generated on-demand by Vault when requested
• Have configurable Time-To-Live (TTL)
• Automatically expire and are cleaned up
• Significantly reduce credential exposure risk

Example: Database credentials generated when an application needs database access, valid for only 1 hour, then automatically revoked.

# Static secret example
vault kv put secret/api-keys stripe_key="sk_test_123456"

# Dynamic secret example (requires database engine setup)
vault read database/creds/readonly

Core Components:

1. Storage Backend: Persists encrypted data (Consul, file system, cloud storage)
2. Barrier: Encrypts/decrypts data before storage using a master key
3. Secret Engines: Handle different types of secrets (KV, databases, PKI)
4. Auth Methods: Handle client authentication (tokens, LDAP, AWS IAM)
5. Policies: Define permissions for authenticated clients
6. Audit Devices: Log all requests and responses for compliance

Data Flow:
Client → Auth Method → Policy Evaluation → Secret Engine → Storage Backend