HashiCorp Vault — Transit Secrets Engine
The Transit secrets engine provides encryption as a service — applications send plaintext to Vault and receive ciphertext, without ever handling encryption keys themselves.
What’s in This Chapter?
| # | Topic | Description |
|---|---|---|
| 1 | Encryption as a Service | Concepts and architecture |
| 2 | Encrypt & Decrypt | Core encrypt/decrypt operations |
| 3 | Key Rotation | Rotating encryption keys, rewrapping |
| 4 | Datakey & Envelope Encryption | Encrypting large data efficiently |
| 5 | Sign & Verify | Digital signatures and HMAC |
| 6 | Practice Exercises | 5 hands-on exercises |
Why Encryption as a Service?
┌─── Without Vault Transit ──┐ ┌─── With Vault Transit ────┐
│ │ │ │
│ App manages encryption │ │ App sends plaintext to │
│ keys in config files │ │ Vault, gets ciphertext │
│ │ │ │
│ ⚠️ Keys in source code │ │ ✅ Keys never leave Vault │
│ ⚠️ Key rotation = hard │ │ ✅ Key rotation = 1 cmd │
│ ⚠️ Audit = impossible │ │ ✅ Full audit trail │
│ ⚠️ Each app re-implements │ │ ✅ Centralized crypto │
└─────────────────────────────┘ └────────────────────────────┘
How Transit Works
┌──────────┐ plaintext ┌──────────┐
│ App │────────────────▶│ Vault │
│ │ ciphertext │ Transit │
│ │◀────────────────│ Engine │
│ │ │ │
│ Stores ciphertext │ Manages │
│ in database │ keys │
└──────────┘ └──────────┘
Key point: Vault handles all crypto. The application never sees the encryption key.
Enable Transit
vault secrets enable transit
Chapter Flow
Start with Encryption as a Service for the conceptual foundation.
Next: Encryption as a Service
