Secret Management with Hashicorp Vault

Banking, Financial Services and Insurance (BFSI)

BUSINESS CHALLENGE

The client recognized the criticality of securing credentials and other sensitive data, prompting their search for a comprehensive tool capable of effectively managing such secrets at scale.

• They sought a cloud-agnostic tool capable of managing data at scale, securing credentials, and handling sensitive data while meeting disaster recovery capabilities with minimal code modifications.
• This included adhering to compliance and regulatory mandates, facilitating encryption, streamlining access control, and seamlessly integrating their DevOps and automation practices.

OUR SOLUTION

We chose HashiCorp Vault as our secret management tool due to its robust support for meeting most of our requirements.

• We designed the HashiCorp Vault set up to establish a highly available and resilient architecture.
• Using Google Kubernetes Engine, we deployed Vault while utilizing Postgres as the storage backend. We implemented regular backups to enhance data protection and incorporated custom encryption using GCP’s Key Management Service.
• To enhance security and simplify access management, we implemented G-Suite SSO for administrative members to access Vault.
• For seamless integration with applications and services, we leveraged GCP IAM and Kubernetes authentication methods.
• We leveraged Terraform to provision Vault and configured CSI drivers on every Kubernetes cluster.
• We deployed the application through Helm while leveraging SecretProviderClass, thus enabling efficient management of sensitive data across environments.