Terraform Advanced — Vault Provider

Generate short-lived, dynamic credentials with HashiCorp Vault.

---

Why Vault?

Static secrets: Created once, stored forever, shared widely
Dynamic secrets: Generated on demand, expire automatically, unique per use

---

Vault Provider Setup

provider "vault" {
  address = "https://vault.example.com:8200"
  # Auth via VAULT_TOKEN env var or other auth method
}

---

Read Secrets from Vault

data "vault_generic_secret" "db" {
  path = "secret/data/prod/database"
}

resource "aws_db_instance" "main" {
  username = data.vault_generic_secret.db.data["username"]
  password = data.vault_generic_secret.db.data["password"]
}

---

Dynamic AWS Credentials

# Vault generates temporary AWS credentials
data "vault_aws_access_credentials" "deploy" {
  backend = "aws"
  role    = "terraform-deploy"
}

provider "aws" {
  access_key = data.vault_aws_access_credentials.deploy.access_key
  secret_key = data.vault_aws_access_credentials.deploy.secret_key
  token      = data.vault_aws_access_credentials.deploy.security_token
}

These credentials expire automatically — no long-lived keys.

---

Managing Vault with Terraform

# Create a Vault secret engine
resource "vault_mount" "kv" {
  path = "secret"
  type = "kv-v2"
}

# Create a policy
resource "vault_policy" "app" {
  name   = "app-read"
  policy = <<-EOT
    path "secret/data/prod/*" {
      capabilities = ["read"]
    }
  EOT
}

💡 Production Tip: Use Vault’s AWS secrets engine to generate temporary IAM credentials for each Terraform run. No static keys anywhere.

---

What’s Next?

Enforce policies with Sentinel.

← Secrets Management Sentinel Policies →