Scribd
Upload
5 views

19-Vault

Uploaded by

20nm440
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
5 views

19-Vault

Uploaded by

20nm440
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 22

Mehdi LARUELLE Be secret like a ninja with

@D2SI Hashicorp Vault


Whoami ?
D2SI Me

Mehdi LARUELLE
Cloud & Automation
@mehdilaruelle
Github Access
Table of contents

1 Contextualization

2 How does Vault work ?

3 Steps to become a ninja

4 Demonstration
1 // Contextualization
Problem ?

Mail Code
Vault ? Why ?
2 // How does Vault work ?
Methods & Engines
Auth methods App
Users

● LDAP ● Approle (pipeline)


● RADIUS ● TLS Certificate
● OKTA ● Kubernetes
● JWT ● JWT / OIDC
● Github ● AliCloud / Azure / AWS
/ GCP
● LDAP
Methods & Engines
Secrets
engines

Dynamic Encryption as
Static secrets
secrets a Service

K/V Cloud Technology Others Transit

● Alicloud ● Active ● PKI


● AWS Directory ● SSH
● GCP ● Consul ● TOTP
● GCP KMS ● Database
● Azure ● Nomad
● RabbitMQ
3 // Steps to become a ninja
Steps to be a ninja

Put secrets in Make secrets Encrypt sensitive


Find secrets
Vault dynamics data
Steps to be a ninja

Put secrets in Make secrets Encrypt sensitive


Find secrets
Vault dynamics data
Approle
How is it working ?

1.
Se Send
cre
t ID

2. Auth with Approle

3. Get Token

end
S ID 4. Get secrets with Vault token
1. ole
R
Steps to be a ninja

Put secrets in Make secrets Encrypt sensitive


Find secrets
Vault dynamics data
Secret as a Service
1.Ask DB credentials

3.Get credentials

5.Ask to revoke credentials

ls
tia
n it
4.A to au

e de ve
cr ie
pp the

e retr
lica nt

ls
a t

tia
re and
tio icat

en
c
lt B
nu ei

ed
au D

cr
V
se nto

2. into

ke
cre DB

vo
Re
de

6.
nti
als
Steps to be a ninja

Put secrets in Make secrets


Find secrets Encrypt data
Vault dynamics
EaaS: Encryption as a Service
Application A Application B
1.Put raw data 5.Put encrypted data

2.Get encrypted data 6.Get decrypted data

3.
Pu
te ta
nc
ry da
pt ed
e pt
d ry
da
ta enc
et
G
4.
Demonstration
To infinity... and beyond!

Consul
service
mesh

envconsul
and / or
consul-
template

Vault Agent
Question ?

The last but not least

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy