HashiCorp Vault — Secrets Engines

1 minute read

Secrets engines are the pluggable components that store, generate, or encrypt data in Vault. Each engine is mounted at a specific path and operates independently.

What’s in This Chapter?

# Topic Description
1 KV Version 1 Simple key-value storage without versioning
2 KV Version 2 Versioned secrets with metadata and soft-delete
3 Enabling Engines Enable, disable, tune, and move secrets engines
4 Paths & Mount Points How Vault routes requests to engines
5 Metadata & Versioning Deep dive into KV v2 metadata and version control
6 Practice Exercises 5 hands-on exercises

Secrets Engines Overview

┌────────────────────────────────────────────────────┐
│                  Vault Server                       │
│                                                      │
│  ┌──────────┐  ┌──────────┐  ┌──────────────────┐  │
│  │ secret/  │  │ database/│  │ transit/          │  │
│  │ (KV v2)  │  │          │  │                   │  │
│  │          │  │ Dynamic  │  │ Encryption as     │  │
│  │ Static   │  │ creds    │  │ a Service         │  │
│  │ secrets  │  │          │  │                   │  │
│  └──────────┘  └──────────┘  └──────────────────┘  │
│                                                      │
│  ┌──────────┐  ┌──────────┐  ┌──────────────────┐  │
│  │ pki/     │  │ aws/     │  │ cubbyhole/        │  │
│  │          │  │          │  │                   │  │
│  │ Cert     │  │ Dynamic  │  │ Per-token         │  │
│  │ authority│  │ AWS IAM  │  │ private storage   │  │
│  │          │  │ creds    │  │                   │  │
│  └──────────┘  └──────────┘  └──────────────────┘  │
└────────────────────────────────────────────────────┘

Types of Secrets Engines

Category Engines Purpose
Static KV v1, KV v2, Cubbyhole Store and retrieve secrets
Dynamic Database, AWS, Azure, GCP, SSH Generate short-lived credentials
Encryption Transit, Transform Encrypt/decrypt data, tokenize sensitive fields
Certificate PKI Issue and manage X.509 certificates
Identity Identity Manage Vault identities and groups

Default Engines

Every Vault server has these engines enabled:

Path Type Description
cubbyhole/ Cubbyhole Per-token private storage (not shared)
identity/ Identity Vault identity management
sys/ System System configuration and status
secret/ KV v2 Only in dev mode — must enable manually in production

Chapter Flow

Start with KV Version 1 to understand the simplest secrets engine, then move to KV Version 2 for versioned secrets.

Next: KV Version 1

You may also enjoy