Keeping Your Secrets a Secret with HashiCorp Vault
August 11, 2019

Keeping Your Secrets a Secret with HashiCorp Vault

Anonymous | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
Verified User

Overall Satisfaction with HashiCorp Vault

HashiCorp Vault is our go-to for secrets management in our cloud implementation. Having used many other HashiCorp products, it was easy enough for us to translate that into the use of Vault. We also use it in a limited capacity with Chef, used in conjunction with encrypted data bags. HashiCorp Vault has allowed us to securely use secrets across applications without the need to expose those secrets. It has also made it easier to implement sane key rotation and achieve automation.

Pros

  • HashiCorp Vault manages secrets extremely well.
  • It works well as a cloud-agnostic or multi-cloud solution.
  • HashiCorp Vault works extremely well with other HashiCorp products.
  • Vault integrates with other systems very well because everything is API driven.

Cons

  • It doesn't have an interface. This isn't entirely bad because of the purpose it serves, but it does make the barrier to entry a little difficult.
  • Unlike many other HashiCorp products, the documentation feels like it leaves some steps out. Step by step documentation lowers the barriers to entry a little bit, and going through even the installation documentation and setup leaves a little bit of the caveats out.
  • It needs a fair bit of supporting infrastructure. You cannot just have a Vault instance. Having a HashiCorp Vault instance means also having a consul cluster for the backend.
I'm rating this a 7 purely because of the barriers to entry with a lack of a user interface. This makes it more difficult to pick up and go because you have to understand how to interact with it via terminal. This is not a huge problem to most, but there will always be those that are simply more comfortable operating with a user interface. Their command-line interface is great, and once you get the hang of it it's relatively straight forward. It's just getting there that's a little bit of a speed bump.
HashiCorp is very responsive on GitHub if you have issues with their products. They also have a very active community. For actual HashiCorp support though, I do not have enough information to give them a solid rating. Historically, pricing has been a concern with HashiCorp support (their paid plan is a bit on the higher end of pricing), so there haven't been any scenarios where I've interacted with them as a whole outside of community channels. Simply having a well versed and accessible community goes a long way for support though as they are a great avenue.
As mentioned before, HashiCorp Vault really is the best in its class. Having used other secrets management tools, HashiCorp has really made Vault the easiest to use in a cross-compatibility function, in a multi-cloud/hybrid environment, and in multiple fashions. Many other tools simply solve a single problem (like encrypted data bags within Chef) but do not help with cross-application compatibility. Using HashiCorp Vault, it's easy to integrate everything through it so you do not have any secrets being exposed. It also gives you a single standardized process so there isn't much guesswork. That alone can aid in making your environment more secure.
HashiCorp Vault, in my opinion, is a defacto standard for any cloud or automation implementation. They're the best of the best as far as products for secrets management and the ability to use it against relatively any service you have is unheard of for other products. HashiCorp has really taken out all the stops when it comes to creating a nice, extensible tool that people can use to suit their needs.

Using HashiCorp Vault

Users are all technical, spanning both development and operations teams. Because we're using HashiCorp Vault as a defacto standard for secrets management, it has been critical ensuring everyone that is in a technical role is up to speed on how to use this tool.
Each team that uses HashiCorp manages their own instance, with a centralized instance being supported as well for cross-team secrets. That requires all teams that are using secrets to have the knowledge and understand of how to administer the tool. As we ensure everything is automated, that has made maintenance of Vault instances much easier, but everyone still needs to know how to do it. In order to administer this tool, in particular, you have to understand how not only Vault works, but how Consul works as well because ultimately you will be maintaining a Consul cluster if you follow HashiCorp's supported set up and recommendations.
  • Secrets Mangement
  • Key Rotation
  • Security
HashiCorp Vault is the best there is out there, and it has become critical to our secret management use cases. It would be difficult to find anything that would suit our needs better and that would be beneficial for us to switch over to.

Comments

More Reviews of HashiCorp Vault

  1. Home
  2. Encryption Key Management Software
  3. HashiCorp Vault Reviews
  4. User Review of HashiCorp Vault