How to prevent creating too many secrets in HashiCorp Vault

user_768722 0
Viewed 397

I am looking for a better solution for secrets rotation and found Vault dynamic secrets is a good one. By enabling secrets engine, say to database, the applications / services can lease dynamic secrets.

I noticed every time the application to lease a database secret, Vault creates a new user / account in the DB. I understand, each application / service needs to be a good citizen and uses the secret as per the lease time. However, in a microservices environment, an implementation bug may cause the services to request too many dynamic secrets thus triggering to create too many accounts in the DB.

Is there any way to prevent creating too many accounts? I am just worrying too many accounts may cause problem in the DB.

hashicorp-vault
1 Answers

You could go down the static roles which would created one role with a fixed user name and then vault would just rotate that password when it needs to be rotated.

Here are some docs to get you started

https://www.vaultproject.io/api/secret/databases#create-static-role https://www.vaultproject.io/docs/secrets/databases#static-roles

Also, a warning from the website:

Not all database types support static roles at this time. Please consult the specific database documentation on the left navigation or the table below under Database Capabilities to see if a given database backend supports static roles.`

user_25995220
Related