Organisations can have security breaches due to any of, amongst other use cases:
Database credentials or access/secret keys being stored in notepad
Secrets handwritten on sticky notes
This is obviously a huge potential security risk, as if secrets like this are compromised, servers, applications, and private data could all be exposed to attack.
HashiCorp Vault aims to mitigate these risks by:
Manage secrets and protect sensitive data
Provide identity-based access management
Generate dynamic secrets e.g. database credentials, AWS secrets, etc.
Consider a developer wanting to authenticate to a database for testing in a system where Vault has been implemented.
Credential request is sent to Vault
Vault immediately generates the credentials for the user
This is hugely beneficial as it doesn't depend on database admins generating the credentials.
Additionally, Vault will monitor the timeframe of these credentials - if the Time-To-Live (TTL) for the credentials passes, Vault will automatically revoke these credentials - the user will then need to generate new credentials.
