Vault Tutorial: Learn Secrets Management from Scratch (2026)
The worst security incident I dealt with was caused by a database password hardcoded in a configuration file committed to a public repository. Vault prevents that entirely. HashiCorp Vault provides secure access to secrets with dynamic generation, lease-based expiration, and detailed audit logging.
By the end of this tutorial, you will understand how Vault authenticates clients, how to generate dynamic database credentials, how to encrypt data with the transit engine, and how to deploy Vault securely in production.
Vault Architecture and Getting Started
Vault has a client-server architecture. The storage backend persists encrypted data. Vault seals itself on startup and must be unsealed with key shares. Auto-unseal with cloud KMS automates this for production. I run Vault in dev mode for learning.
vault server -dev -dev-root-token-id=root
export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN=root
vault status
vault secrets listStatic Secrets: KV Secrets Engine
The KV secrets engine stores arbitrary secrets as key-value pairs. The v2 engine supports secret versioning, deletion with recovery, and configurable max versions. Paths organize secrets by application and environment: secret/dev/web/db-password.
vault secrets enable -version=2 kv
vault kv put kv/web/db-password username=app password=s3cret
vault kv get kv/web/db-password
vault kv rollback kv/web/db-password 1Dynamic Secrets: Databases and Cloud Providers
Dynamic secrets are Vault's killer feature. Instead of storing a static database password, Vault generates a unique, time-limited credential on each request. When the lease expires, Vault automatically revokes the credential. This eliminates the secret rotation problem entirely.
vault secrets enable database
vault write database/config/postgresql-db plugin_name=postgresql-database-plugin allowed_roles="readonly" connection_url="postgresql://{{username}}:{{password}}@postgres:5432/mydb"
vault read database/creds/readonlyEncryption as a Service: The Transit Engine
The transit secrets engine handles cryptographic operations without exposing encryption keys to applications. Your application sends plaintext to Vault's encrypt endpoint and receives ciphertext. Vault manages key rotation and key versioning. This is essential for encrypting PII and financial data.
vault secrets enable transit
vault write -f transit/keys/my-key
echo "sensitive-data" | base64 | vault write transit/encrypt/my-key plaintext=-Authentication Methods and Policies
Clients must authenticate before accessing secrets. Vault supports many auth methods: token, Kubernetes (service account tokens), LDAP, AWS IAM, JWT/OIDC. Policies are HCL rules that grant capabilities on paths. A well-designed policy follows least privilege.
path "kv/data/web/*" {
capabilities = ["read", "list"]
}
path "database/creds/readonly" {
capabilities = ["read"]
}Production Hardening and Audit Logging
Use auto-unseal with AWS KMS or Azure Key Vault. Run Vault on dedicated infrastructure. Enable audit logging to capture every request. Response wrapping delivers secrets in single-use-wrapped tokens. Regular DR drills should include unseal procedure practice.
vault audit enable file file_path=/var/log/vault/audit.log
vault operator raft snapshot save /tmp/vault.snap
vault operator sealFrequently Asked Questions
What is the difference between Vault and AWS Secrets Manager?
Vault is multi-cloud, self-hosted with dynamic secrets and encryption as a service. AWS Secrets Manager is a managed service for AWS-only secret storage with automatic rotation for RDS.
How do I back up Vault?
For Integrated Storage (Raft), use vault operator raft snapshot save. Store snapshots in a secure, encrypted location. Unseal keys and root token must be backed up separately.
Can Vault handle high throughput?
Yes, with proper sizing. Use performance standby nodes for read-heavy workloads. Batch transit operations for high-volume encryption.
How do Vault leases work?
Every dynamic secret has a lease with a TTL. The client must renew before expiry. When the lease expires, Vault automatically revokes the credential.
Originally published on Ayodhyyya. Last updated June 1, 2026.