Vault (software)

Vault (software)
Name	Vault
Developer	HashiCorp
Initial release	2015
Latest release	1.12 (example)
Programming language	Go
License	Mozilla Public License 2.0
Website	https://www.hashicorp.com/products/vault

Vault (software) is a secrets management and data protection tool created to secure, store, and tightly control access to tokens, passwords, certificates, and encryption keys. It provides a central service for dynamic credential generation, encryption as a service, and secret leasing, supporting use in cloud-native and hybrid infrastructures. Organizations use it to reduce secret sprawl and enforce least-privilege access across services, containers, and platforms.

Overview

Vault was developed by HashiCorp to address secret storage and dynamic credential issuance needs in modern infrastructure environments such as Amazon Web Services, Microsoft Azure, Google Cloud Platform, and private data centers. It centralizes secrets management for applications, orchestration platforms like Kubernetes, configuration management systems such as Ansible and Terraform, and service mesh solutions including Istio. Vault's model emphasizes secure secret retrieval, audit logging, and fine-grained access control compatible with identity providers like Okta, Azure Active Directory, and GitHub.

Architecture and Components

Vault is built in Go (programming language) and follows a client–server architecture comprising a server process, clients, storage backends, and secret engines. Its storage backends include options like Consul (software), Amazon S3, Google Cloud Storage, and relational databases. Vault's core components include the core server, authentication methods (e.g., LDAP, OAuth 2.0), secret engines (e.g., key/value, PKI, database), and audit devices. High-availability and scalability features integrate with orchestration systems such as Kubernetes and clustering technologies like Raft consensus algorithm. Vault's API-first design allows interaction via CLI, HTTP API, and SDKs in languages such as Python (programming language), Java (programming language), Go (programming language), and Ruby (programming language).

Features and Use Cases

Vault provides dynamic credential generation for databases like PostgreSQL, MySQL, and cloud services such as AWS IAM and Google Cloud IAM, reducing long-lived credentials. Its encryption-as-a-service supports use cases like tokenization, data-at-rest encryption for storage systems like Ceph and HDFS, and envelope encryption for platforms such as Amazon S3. Vault’s PKI secret engine issues short-lived TLS certificates for services relying on NGINX, Envoy, or HAProxy, enabling automated certificate rotation. Other features include secret leasing and renewal, key revocation, sealed/unsealed lifecycle, namespaces for multi-tenant setups often used by enterprises like Salesforce and SAP, and audit logging compatible with systems like Splunk and ELK Stack.

Security and Compliance

Vault implements encryption of secrets using algorithms approved by standards bodies such as NIST and supports Hardware Security Modules (HSMs) conforming to FIPS 140-2 for key protection, integrating with vendors like Thales Group and AWS CloudHSM. Its access control leverages policies and token-based authentication, and integrates with identity providers including Okta, Ping Identity, and Azure Active Directory to support zero-trust and least-privilege models championed by organizations like Google LLC and Microsoft Corporation. Audit logging and immutable event records assist in compliance regimes such as SOC 2, PCI DSS, and GDPR. Secrets lifecycle controls and short TTLs aid in meeting requirements from regulatory bodies like ISO/IEC standards.

Deployment and Operations

Vault can be deployed on-premises, in public clouds like Amazon Web Services, Microsoft Azure, and Google Cloud Platform, or orchestrated via Kubernetes and infrastructure-as-code tools such as Terraform. Operational concerns include secure initialization and unsealing (manual unseal, auto-unseal via HSM or cloud KMS like AWS KMS), backup and recovery with storage backends like Consul (software) or etcd, monitoring with exporters for Prometheus, and logging to platforms such as Splunk or Datadog. High-availability deployments use leader election and replication strategies informed by consensus technologies like Raft consensus algorithm. Day-2 operations often involve lifecycle automation, policy governance, and secret rotation practices used by enterprises like Netflix and Airbnb.

Integrations and Ecosystem

Vault integrates with a wide ecosystem: configuration and provisioning tools like Terraform, Ansible, and Puppet; CI/CD systems such as Jenkins, GitLab CI/CD, and GitHub Actions; service meshes like Istio and Linkerd; and container platforms like Docker and Kubernetes. It also connects with cloud-native observability stacks including Prometheus and Grafana, and security platforms like HashiCorp Sentinel (policy as code), Vault Enterprise features for governance, and SIEM systems such as Splunk and Elastic (company). Third-party SDKs, community plugins, and HashiCorp's own suite (e.g., Consul (software), Nomad (software)) extend Vault’s capabilities for orchestration, service discovery, and secret injection.

History and Development

Vault was introduced by HashiCorp in the mid-2010s as part of a wave of infrastructure tooling that included Vagrant (software), Packer (software), Terraform, and Consul (software). Early releases focused on static secret storage and ACL policies, with later development adding dynamic secret engines, storage backends, auto-unseal, and enterprise features for multi-datacenter replication and namespaces. HashiCorp’s roadmap and community contributions—via channels like GitHub and conferences such as HashiConf—have driven integrations with cloud providers (Amazon Web Services, Microsoft Azure, Google Cloud Platform), orchestration platforms (Kubernetes), and identity systems (Okta, Azure Active Directory). The project has been adopted by technology companies including Netflix, Airbnb, Dropbox (service), and financial institutions seeking strong secret management and cryptographic services.

Category:Computer security software