Introduction to Secrets Engines

When you check into a hotel, you receive a room key—much like obtaining a token in HashiCorp Vault. Once Authenticated, you can use that token (or key card) to access your room, gym, or spa without returning to the front desk every time.

In Vault, Secrets Engines are like these hotel amenities: they represent the capabilities you want to access once you present a valid token.

Once your token is validated, you can interact with one or more Secrets Engines without re-authenticating. These engines provide functionality such as storing static credentials, generating dynamic secrets, encrypting data, issuing certificates, and more.

What Are Secrets Engines?

A Secrets Engine is a plugin-style component in Vault that you enable at a specific mount path. Each engine can:

• Store static key/value data
• Generate dynamic credentials on demand
• Encrypt/Decrypt data (via the Transit engine)
• Issue certificates (via the PKI engine)

You can enable multiple engines—including multiple instances of the same type—by assigning unique mount paths.

Defining a Secret

A secret is any piece of data your organization considers sensitive:

• Usernames and passwords
• API keys, tokens, or SSH credentials
• TLS certificates and private keys
• Database credentials
• Application configuration files

Vault treats secrets as a service. You generate, manage, and revoke them on demand, backed by leases and audit trails:

• Dynamic Credentials: Unique, short-lived credentials reduce blast radius.
• Automatic Revocation: Secrets expire at the end of their lease.
• Audit Trails: Full visibility into who accessed what and when.

Scenario: A fleet of web servers requests dynamic database credentials from Vault. If one server is compromised, only its credentials are affected. You can pinpoint and revoke its credentials without impacting others.

Dynamic Credentials Workflow

1. Application Request
   The web app requests AWS credentials from Vault’s AWS Secrets Engine.
2. Credential Generation
   Vault dynamically creates IAM credentials tied to a lease.
3. Use of Credentials
   The application uses these to access AWS services (e.g., S3).
4. Automatic Revocation
   Credentials expire and are revoked at the end of their lease.

On the admin side, you typically run:

vault secrets enable aws
vault write aws/config/root \
    access_key=<YOUR_ACCESS_KEY> secret_key=<YOUR_SECRET_KEY> region=us-west-2
vault write aws/roles/app-role \
    [email protected] \
    ttl=60m

Built-In Secrets Engines

Vault includes a broad set of engines by default. Select and enable the ones you need:

Key/Value (KV) Secrets Engine

Use the KV engine to store static data.

• KV v1: Overwrites on write; no history.
• KV v2: Versioned store; supports history and rollback.

Database Secrets Engine

Dynamically generate database credentials for many backends:

• Cassandra, Couchbase, Elasticsearch, HANA DB, InfluxDB
• MongoDB, Microsoft SQL Server, MySQL/MariaDB (Aurora, RDS)
• Oracle, PostgreSQL, Redshift, Snowflake
• Custom database plugins

Grouping Secrets Engines by Function

• Cloud Platforms: AWS, Azure, GCP, Alibaba
• Databases: SQL/NoSQL backends
• Identity/Access: Active Directory, Consul, OpenLDAP, Cubbyhole
• Security & Encryption: KMIP, PKI, Transit, Transform, Venafi
• Storage: KV v1 & v2

Overview of Built-In Engines

• Active Directory
  Rotate service account passwords; Vault requires a service account for rotation.
• Cloud (AWS/Azure/GCP)
  Dynamic cloud credentials for resource access.
• Consul
  Issue ACL tokens programmatically.
• Cubbyhole
  Token-scoped private storage space.
• Database
  On-demand DB credentials.
• KMIP (Enterprise)
  Vault acts as a KMIP server for storage encryption.
• KV (v1/v2)
  Simple vs. versioned key/value storage.
• Identity
  Built-in identity and group management.
• MongoDB Atlas, Nomad, OpenLDAP
  Platform-specific credential generators.
• PKI
  Vault as a Certificate Authority for TLS/mTLS.
• RabbitMQ, SSH, TOTP, Terraform Cloud
  Short-lived credentials and tokens.
• Transit
  Encryption-as-a-service; stateless crypto API.
• Transform (Enterprise)
  Data tokenization and masking.
• Venafi
  Certificate issuance via Venafi integration.

Next Steps

You’ve learned the core concepts and built-in Secrets Engines in Vault. In the following sections, we’ll dive into configuration examples, best practices, and real-world use cases for each engine.

References

• Vault Documentation – Secrets Engines
• Dynamic Secrets
• KV Secrets Engine
• HashiCorp Vault on GitHub