HashiCorp Vault — Security Model

2 minute read

Understanding Vault’s security model helps you assess risk and build proper defenses around your secrets management infrastructure.

Trust Boundaries

┌─────────────────────────────────────────────┐
│              External Network                │
│  ┌─────────────────────────────────────┐    │
│  │           Load Balancer (TLS)       │    │
│  │  ┌─────────────────────────────┐    │    │
│  │  │     Vault Cluster (TLS)     │    │    │
│  │  │  ┌─────────────────────┐    │    │    │
│  │  │  │  Storage Backend    │    │    │    │
│  │  │  │  (Encrypted at rest)│    │    │    │
│  │  │  └─────────────────────┘    │    │    │
│  │  └─────────────────────────────┘    │    │
│  └─────────────────────────────────────┘    │
└─────────────────────────────────────────────┘

What Vault Protects Against

Threat Protection
Secrets in plaintext Encryption at rest (barrier encryption)
Unauthorized access Auth methods + policies
Lateral movement Dynamic secrets with short TTLs
Stolen database credentials Auto-rotation, lease revocation
Insider threats Audit logging, Shamir’s key sharing
Compromised single server Sealed state, encryption key not on disk
Network eavesdropping TLS for all communication

What Vault Does NOT Protect Against

Threat Why
Compromised application App has a valid token — Vault serves secrets
Compromised Vault server (unsealed) Secrets are in memory
Root token holder Full access to everything
All unseal key holders collude Can reconstruct master key
Cloud provider compromise KMS auto-unseal keys at risk

Encryption Layers

Client ──TLS──► Vault ──barrier encryption──► Storage
                  │
                  ├── Master Key (in memory only)
                  │     ├── Encrypts/decrypts the barrier
                  │     └── Reconstructed from unseal keys
                  │
                  ├── Barrier (AES-256-GCM)
                  │     ├── All data written through barrier
                  │     └── Storage backend sees only ciphertext
                  │
                  └── Transit keys (separate from barrier)
                        └── Application-level encryption

Threat Model Scenarios

Scenario 1: Storage Backend Compromised

Impact: Attacker gets encrypted data only.

  • Vault encrypts all data before writing to storage
  • Without the master key, data is unreadable
  • Master key is never written to storage

Scenario 2: Network Interception

Impact: Mitigated by TLS.

  • All client ↔ Vault traffic is TLS-encrypted
  • Cluster traffic (node-to-node) is TLS-encrypted
  • Certificate pinning for additional security

Scenario 3: Vault Server Memory Dump

Impact: Secrets in memory could be exposed.

  • Use disable_mlock = false to prevent swapping
  • Short lease TTLs minimize secrets in memory
  • Seal Vault immediately if compromise detected

Scenario 4: Stolen Vault Token

Impact: Access to secrets within token’s policy scope.

  • Short TTLs limit exposure window
  • Token use limits (num_uses)
  • CIDR binding restricts token to specific IPs
  • Audit logs detect unauthorized access patterns

Defense in Depth

Layer Control
Network Private subnet, firewall, TLS
Authentication Multi-factor, short-lived tokens
Authorization Least-privilege policies
Encryption Barrier encryption, TLS, Transit
Audit All requests logged, tamper detection
Operations Shamir’s keys, sealed by default
Monitoring Health checks, anomaly detection

Seal/Unseal Security

State Secrets Accessible? Master Key in Memory?
Sealed ❌ No ❌ No
Unsealed ✅ Yes (with valid token) ✅ Yes
Standby (unsealed) Forwards to leader ✅ Yes 
# Emergency: seal Vault immediately
vault operator seal
# All secrets become inaccessible until re-unsealed

Token Security Best Practices

# CIDR-bound tokens
vault token create -policy=myapp \
    -ttl=1h \
    -bound-cidrs="10.0.1.0/24"

# Limited-use tokens
vault token create -policy=myapp \
    -ttl=1h \
    -use-limit=5

# Orphan tokens (not tied to parent's lifecycle)
vault token create -policy=myapp -orphan

# Periodic tokens (renewable indefinitely, but must be renewed)
vault token create -policy=myapp -period=1h

Next: Operational Procedures

You may also enjoy