HashiCorp Vault for Secrets Management and Encryption-as-a-Service

AWS Secrets Manager and GCP Secret Manager are excellent for single-cloud workloads — managed, low-ops, native IAM integration. Vault is the right choice when you need cloud-agnostic secrets management, dynamic credential generation (database, PKI), encryption-as-a-service via the transit engine, or fine-grained policy control across a multi-cloud or on-premise hybrid environment. Many organisations run both: cloud-native managers for cloud-service credentials, Vault for cross-cutting secrets and encryption.

Dynamic secrets are short-lived credentials generated by Vault on demand and scoped to a single application instance or request. When the TTL expires, the credential is automatically revoked. An attacker who obtains a dynamic database password has seconds or minutes to use it, not months. Static credentials, by contrast, remain valid until manually rotated — which often never happens. Dynamic secrets also eliminate the credential-sharing problem: every service instance gets a unique credential, so a breach is containable.

The transit engine exposes encrypt and decrypt API endpoints. Your application sends plaintext to Vault and receives ciphertext back — the raw encryption key never leaves Vault. Keys are versioned; rotation creates a new key version while old ciphertext remains decryptable. A rewrap operation re-encrypts existing ciphertext under the new key version in bulk. This pattern removes cryptographic responsibility from application code entirely and centralises key lifecycle management.

Yes. The Vault PKI secrets engine acts as a certificate authority (intermediate CA, rooted to an offline root CA). Combined with cert-manager or Vault Agent, it issues X.509 certificates for services on demand and renews them automatically before expiry. For mTLS, each service receives a unique certificate bound to its identity. Short-lived certificates (24 hours) reduce the risk window of a compromised certificate compared to traditional year-long CA-signed certs.

Three main patterns: (1) Vault Agent Injector — a mutating webhook that injects a Vault Agent sidecar into annotated pods; the agent authenticates via the Kubernetes auth method and writes secrets to a shared in-memory volume. (2) External Secrets Operator — a Kubernetes operator that syncs Vault secrets into native Kubernetes Secrets on a schedule. (3) Secrets Store CSI Driver — mounts Vault secrets as ephemeral volumes directly into pods. We select the pattern based on your secret rotation requirements and tolerance for in-memory vs Kubernetes Secret storage.

We deploy a Vault cluster with integrated Raft storage across three or five nodes in separate availability zones. Auto-unseal is configured with a cloud KMS key (AWS KMS, GCP Cloud KMS or Azure Key Vault) so nodes unseal automatically after restart without manual operator intervention. A load balancer routes traffic to the active node; standby nodes serve reads in Enterprise or warm-standby in open-source. Health check endpoints drive load balancer target group membership. Runbooks cover leader failover, node replacement and disaster recovery from Vault snapshots.

Vault is an enabler, not a compliance certificate. HIPAA requires encryption of PHI at rest and in transit, access controls and audit logging — Vault's transit engine, policies and audit devices satisfy the technical requirements of these controls when correctly configured. PCI DSS requires key management procedures, unique credentials per user and audit trails — Vault's database secrets engine and audit devices address these. We implement the Vault infrastructure and document the control mapping; formal HIPAA or PCI compliance requires the full organisational and procedural programme, not just the tooling.