What is Vault?
Vault is a secrets management tool from HashiCorp that securely stores, accesses, and tightly controls access to tokens, passwords, certificates, encryption keys, and other sensitive data through a UI, CLI, or HTTP API. Vault distinguishes itself by combining secrets storage with dynamic credential generation and Encryption as a Service, so teams can protect data in transit and at rest rather than relying on static, long-lived secrets.
Key Features
- Key/Value Secrets Engine: A key-value store that persists arbitrary secrets within the configured physical storage for Vault, giving teams a central place to store and retrieve application secrets.
- Database Secrets Engine: Dynamically generates database credentials based on pre-configured roles and manages the database credential lifecycle, removing the need for static database passwords.
- Transit Secrets Engine: Encrypts data in transit to provide encryption as a service, allowing applications to encrypt and decrypt data without storing encryption keys themselves.
- Transform Secrets Engine: An Enterprise feature that generates cryptographically secure tokens mapped to highly sensitive data, so sensitive values can be replaced with tokens that are safe to handle.
- Encryption as a Service (EaaS): Fortifies data during transit and at rest, so even if an intrusion occurs, data remains encrypted and an attacker cannot obtain the raw data.
- Multiple Access Interfaces: Vault can be managed and consumed through a UI, a CLI, or an HTTP API, fitting different developer and operations workflows.
- Identity and Access Management: Vault supports designing a strong identity and access management strategy, as covered in HashiCorp's Well Architected Framework guidance.
- Sandbox Environment: A Vault sandbox with preinstalled tools and services lets users experiment with Vault before deploying it.
Use Cases
- Application and infrastructure secrets management: Store, access, and deploy secrets for applications, systems, and infrastructure from a single controlled system.
- Database credential management: Secure database access and manage the database credential lifecycle using Vault's database secrets engine, avoiding hardcoded credentials.
- Data encryption: Use Encryption as a Service to encrypt sensitive data in transit and at rest, so raw data stays protected even if an intrusion occurs.
- Security and platform teams designing zero-trust architecture: Apply HashiCorp Well Architected Framework best practices for securing data, secrets, identity and access management, and infrastructure.
- Certification candidates: Prepare for the Vault Associate (003) and Vault Operations Advanced certification exams with dedicated tutorial tracks and sample questions.
Who It Is For
Vault is built for developers, operations teams, and security engineers who need to manage secrets and protect sensitive data across applications, systems, and infrastructure. It solves the problem of scattered, static credentials and unencrypted sensitive data by centralizing secrets storage, generating dynamic database credentials, and providing encryption as a service. Teams preparing for Vault certifications and organizations designing zero-trust architectures are also directly served by its documentation and best-practice guidance.
Pricing
The source material does not state Vault's pricing model. It does note that HCP Vault Dedicated can be tried for free, and that a Vault sandbox with preinstalled tools and services is available for experimentation.
Frequently Asked Questions
What is Vault used for?
Vault is used to securely store, access, and tightly control access to tokens, passwords, certificates, encryption keys, and other sensitive data. It also generates dynamic database credentials and provides encryption as a service for data in transit and at rest.
What are the main features of Vault?
Vault's popular features include the Key/Value Secrets Engine for persisting arbitrary secrets, the Database Secrets Engine for dynamic database credentials, the Transit Secrets Engine for encryption as a service, and the Transform Secrets Engine (an Enterprise feature) for tokenizing highly sensitive data.
How do you access Vault?
Vault can be used through a UI, a CLI, or an HTTP API. HashiCorp provides developer and operations quick starts, tutorials, documentation, and a sandbox with preinstalled tools and services for experimentation.
Is Vault free to try?
The source material does not describe Vault's pricing. It states that HCP Vault Dedicated can be tried for free and that a Vault sandbox is available for hands-on experimentation.
Who should use Vault?
Vault suits developers, operations teams, and security engineers who need centralized secrets management, dynamic database credentials, or encryption as a service. It is also relevant to practitioners pursuing Vault Associate (003) or Vault Operations Advanced certification and to teams applying zero-trust security best practices.
