domains / families / security / implementing-hashicorp-vault-dynamic-secrets

implementing-hashicorp-vault-dynamic-secrets

separate

'Configures HashiCorp Vault dynamic secrets engines for database credentials,

When to use

• Applications use static database credentials stored in configuration files or environment variables
• AWS IAM access keys are long-lived and shared across services
• Need to eliminate credential sprawl by generating short-lived, per-request secrets
• Compliance requirements mandate credential rotation (PCI-DSS Requirement 8, NIST 800-53 IA-5)
• Implementing zero-trust secret management where credentials are never stored at rest
• Migrating from manual credential management to automated secrets lifecycle

When not to use

• storing static secrets that cannot be dynamically generated

Skill page

Source