5 ms·

Also interested in this, we have a fairly large setup and always interesting to see how others use it. Especially around Vault, it never really clicked for me,

by gopaz 7y ago

Also interested in this, we have a fairly large setup and always interesting to see how others use it. Especially around Vault, it never really clicked for me, I fail to see how it helps most of the times, if a user can trigger X that will generate a key on the fly, what prevents a hacker from doing the same, etc...

pas 7y ago
You can audit access/key-genesis, easily revoke keys, have stricter rules for giving out keys. It's a complexity-compartmentalization trade off, that is usually recommended for better IT sec posture. Allows other stuff [IDS - intrusion detection system] to be built on top more easily. Basically leads to the secrets in the secret vault mentality, so any time you see a secret not in the vault, you can sound the alarm.