HashiCorp Vault — Dynamic Secrets

2 minute read

Dynamic secrets are generated on demand and automatically revoked when their lease expires. This eliminates credential sprawl and ensures every client gets unique, short-lived credentials.

What’s in This Chapter?

# Topic Description
1 Database Secrets Engine Dynamic database credentials overview
2 PostgreSQL & MySQL Hands-on: dynamic credentials for relational databases
3 AWS Secrets Engine Dynamic AWS IAM credentials
4 Azure & GCP Secrets Dynamic cloud credentials
5 Lease Management Renewing, revoking, and managing leases
6 Practice Exercises 5 hands-on exercises

Static vs Dynamic Secrets

┌─── Static Secrets (KV) ───┐    ┌─── Dynamic Secrets ────────┐
│                            │    │                             │
│  Admin creates password    │    │  Vault generates unique     │
│  Stores in KV              │    │  credentials per request    │
│  Shares with 10 apps       │    │                             │
│  All apps use SAME cred    │    │  App A gets: user_abc / pw1 │
│  Password rotated manually │    │  App B gets: user_def / pw2 │
│  Who used it? Unknown.     │    │  App C gets: user_ghi / pw3 │
│                            │    │                             │
│  ⚠️ Shared = risky          │    │  ✅ Unique = auditable       │
│  ⚠️ Long-lived = dangerous  │    │  ✅ Short-lived = safe       │
│  ⚠️ Manual rotation         │    │  ✅ Auto-revocation          │
└────────────────────────────┘    └─────────────────────────────┘

How Dynamic Secrets Work

┌──────────┐     ┌──────────────┐     ┌────────────────┐
│  Client  │     │    Vault     │     │   Database /   │
│          │     │              │     │   Cloud / etc  │
│ ① Request│────▶│              │     │                │
│  creds   │     │ ② Generate   │────▶│ ③ Create user  │
│          │     │    unique    │◀────│   with perms   │
│          │◀────│    creds     │     │                │
│          │     │              │     │                │
│ ④ Use    │─────│──────────────│────▶│ ⑤ Access DB    │
│  creds   │     │              │     │                │
│          │     │ ⑥ Lease      │     │                │
│          │     │   expires    │────▶│ ⑦ Drop user    │
└──────────┘     └──────────────┘     └────────────────┘

The flow:

  1. Client requests credentials from Vault
  2. Vault generates a unique username/password
  3. Vault creates the user on the target system
  4. Client uses the credentials
  5. When the lease expires, Vault revokes (drops) the user

Supported Dynamic Secrets Engines

Engine Generates
Database PostgreSQL, MySQL, MongoDB, MSSQL, Oracle, Redis, Elasticsearch credentials
AWS IAM users, STS assumed roles, federation tokens
Azure Service principals, managed identity tokens
GCP Service account keys, OAuth tokens
Consul Consul ACL tokens
Nomad Nomad ACL tokens
RabbitMQ User credentials
LDAP Dynamic LDAP entries

Key Concepts

Concept Description
Lease A time contract — credentials are valid for this duration
Lease ID Unique identifier for managing the lease
TTL Time-to-live for the credentials
Max TTL Maximum time credentials can exist (even with renewals)
Revocation Vault deletes/disables the credentials on the target system

Chapter Flow

Start with Database Secrets Engine for the most common dynamic secrets pattern.

Next: Database Secrets Engine

You may also enjoy