implementing-hashicorp-vault-dynamic-secrets

What problem does it solve?

This Skill eliminates static, long-lived credentials by implementing HashiCorp Vault dynamic secrets for databases, AWS IAM, and PKI certificates, reducing credential sprawl and enabling automated rotation and revocation for improved security and compliance.

Core Features & Use Cases

• Dynamic Database Credentials: Create time-limited PostgreSQL and MySQL users on demand with revocation statements and TTL controls.
• Ephemeral AWS IAM Keys: Generate IAM user keys, assumed-role STS tokens, and federation tokens with configurable leases to avoid long-lived AWS credentials.
• PKI Certificate Issuance: Issue short-lived TLS certificates via Vault PKI (root/intermediate) for web services and service mesh.
• Lease Management & Monitoring: Automatic lease renewal patterns, scripted revocation, audit log analysis, and Prometheus metrics for operational visibility.
• Application Integration: AppRole authentication examples and a Python agent demonstrating credential retrieval, renewal, and revocation for microservices and CI/CD pipelines.
• Use Case: Migrate many microservices from environment-stored DB passwords to per-service Vault roles with automatic rotation and minimal code changes.

Quick Start

Request dynamic database credentials for role app-readonly and return the username, password, lease_id, and lease_duration.