Secrets in Vault
Four articles that take one web application from a password sitting in its configuration to no secret in the code at all. They were written to be read in order, each one starting where the last stopped, and each comes with a repository you can run.
The order is the order the work happens in: put the secret somewhere else first, then stop it being a fixed value, then stop the application handling the data in clear, then stop it talking to Vault at all.
2019
- Migrate your application secrets in Vault (step 3) Encrypt and decrypt your application's data with HashiCorp Vault, without the application ever holding a key. Step 3 of the Vault migration series.
- Migrate your application secrets in Vault (step 2) Replace a static database password with credentials HashiCorp Vault generates on demand and expires on its own. Step 2 of the Vault migration series.
- Migrate your application secrets in Vault (step 1) Move the secrets out of your application's configuration into HashiCorp Vault, with Terraform and without touching the code. Step 1 of the series.