Secrets Management & Vault

What is secrets management?

Secrets management is securely storing and controlling sensitive values used by apps and infrastructure:

• AWS access keys
• Database passwords
• API keys
• SSH private keys
• JWT / OAuth tokens
• TLS certificates

Why not hardcode secrets?

resource "aws_instance" "web" {
  ami           = "ami-0199ac7c9fbf9ed83"
  instance_type = "t3.micro"
  key_name      = "terraform-key"
}

Problems:

• Visible to anyone with repo access
• Easy to leak via GitHub history
• No centralized rotation or audit trail
• High security risk in shared codebases

Better approach

Terraform
      ↓
HashiCorp Vault
      ↓
Retrieve secret
      ↓
Launch EC2

What is HashiCorp Vault?

Vault is a centralized secrets management tool. It stores passwords, API keys, cloud credentials, certificates, database credentials, and SSH keys — and issues short-lived credentials when possible.

Real-world flow with Terraform

Developer
      ↓
terraform apply
      ↓
HashiCorp Vault
      ↓
Retrieve secrets
      ↓
AWS provider
      ↓
EC2 instance

Without Vault, secrets sit in .tf files. With Vault, secrets stay out of code.

Authentication methods

Vault supports many auth methods: token, userpass, GitHub, LDAP, AWS IAM, Kubernetes, and AppRole.

For automation (Terraform, Jenkins, GitHub Actions, GitLab CI, Ansible), AppRole is the usual choice instead of a root token.

AppRole flow

Terraform
      ↓
Role ID + Secret ID
      ↓
Vault login
      ↓
Vault issues a token
      ↓
Terraform reads secret
      ↓
Launch EC2