[ SRE_ARENA ]
← BACK TO ROADMAP
SECRET MANAGEMENT

If a Human Knows the Password, You've Already Failed.

Visualization: 1. HashiCorp Vault & Dynamic Secrets
DOWNLOADING CONCEPT: 1. HASHICORP VAULT & DYNAMIC SECRETS...
  • ↳HashiCorp Vault is the gold standard.
  • ↳Instead of storing a static password, Vault issues Dynamic Secrets.
The Flow
  • ↳1. The API Server authenticates with Vault (often using its Kubernetes Service Account JWT or an AWS IAM role).
  • ↳Vault verifies this identity.
  • ↳2. Vault returns a temporary Vault Token.
  • ↳3. The API requests database credentials.
  • ↳4. Vault physically connects to the Database and runs CREATE USER temp_user_123 WITH PASSWORD ....
  • ↳5. Vault hands these credentials to the API with a strictly enforced Time-to-Live (TTL) of, say, 1 hour.
  • ↳6. After 1 hour, Vault automatically logs into the database and drops the user.
  • ↳The API must request a new one.

↳*If the server is breached, the attacker only gets a password that expires in minutes, not a master admin password.*

▲ LIVE INCIDENTA developer committed a raw AWS Access Key to a public GitHub repository. They realized the mistake 5 minutes later and force-pushed to remove it.
sre@arena:~/secret-management
sre@arena:~$ git log -p | grep AKIA