HashiCorp Certified: Vault Associate 2023

Discover how HashiCorp Vault securely stores secrets and manages access with dynamic secrets, automatic rotation, and a GUI for on-demand AWS, database, and Linux credentials, plus encryption.

Download the windows vault binary, choose 64-bit if your system is 64-bit, extract it to a binaries folder, and add that folder to PATH, then restart the command prompt.

Learn to install vault on linux and mac via manual installation: download binary, unzip, move to /usr/local/bin, and update path; mac can use brew, but manual installs ensure latest version.

Learn how to run Vault in development mode for local testing, and understand in-memory data, root tokens, and vault_addr for http access.

Store and version secrets in vault using the key-value secret engine, then read, write, and manage versions via the graphical user interface and the command line interface in development mode.

Explore how dynamic secrets generate credentials on demand within vault secret engines, using AWS IAM credentials with on-demand access keys, lease durations, and automatic revocation.

Enable the AWS engine in Vault, configure a developer access role with a policy document, and generate dynamic AWS credentials (access key and secret key) for users.

Explore path based revocation in Vault: revoke a specific lease by id or revoke all leases under a path using path prefix, since lease ids begin with secret path.

Explore how vault's transit secret engine provides encryption as a service for data in transit, encrypting and decrypting with a demo key without storing plaintext data.

Generate a data key and encrypt large data locally with transit secret engine, then store the cipher text for decryption. This reduces network latency and mirrors AWS KMS data keys.

Explore key rotation, minimum decrypt version, and rewrapping data in Vault's transit secret engine to secure and manage encryption keys across versions.

Explore how the Vault PKI secrets engine dynamically issues certificates, acting as an intermediate certificate authority to simplify CSR generation, signing, and delivery.

Explore how Vault authenticates users using username and password, tokens, and other methods, and learn the basics of creating a user, logging in, and understanding token-based access and policies.

Learn how vault policies enforce access via path-based ACL rules, attaching policies to users and tokens, and balancing root, default, and user-defined policies with read, write, and sudo capabilities.

Learn vault policies part two, detailing version 2 kv prefixes (secret data) for write and read, and using metadata to list, read, and destroy secret versions.

Learn how AppRole authentication with Vault works for machines and apps: create policies and roles, generate role_id and secret_id, deliver them to apps, and obtain a token for operations.

Learn how the vault token capabilities command reveals a token's permissions on a path, including create, read, update, and delete. Video demonstrates validating capabilities with CIS endpoints and ACL policies.

Vault maps multiple identity providers to a single user via entities and aliases, managed by the identity secret engine. Tokens inherit the entity policy; aliases may have their own policies.

Explore how identity groups hold multiple entities, apply the team-engineering policy to all members, and distinguish internal versus external groups linked to providers like Active Directory.

Explore vault's tools tab to generate random bytes and hash data, with base64 or hex outputs. Learn to use sis tools api endpoints for random and hash operations.

Learn how to use Vault autocomplete to speed up Vault command-line interface commands and arguments, install autocomplete, restart your shell, and apply it to operator commands like seal.

Configure the transit secret engine by creating a demo key, applying a policy with transit encrypt and transit decrypt using update, plus list and read to manage keys.

Explore how vault tokens authenticate access, map to policies, and influence token lifecycles, including root tokens, user pass method, and token lookup for policy visibility.

Learn how the vault token helper caches the root token at dot vault-token in your home directory and how removing that file logs you out by blocking token lookups.

Explore how time-to-live governs vault tokens, including default and max TTLs, token renewal, and explicit TTL settings, with practical CLI examples.

Explore the service token life cycle in Vault, where parent tokens create child tokens and a revoked or expired parent removes all its children.

Identify orphan tokens as root tokens not tied to a parent, so they won't expire when the parent is revoked. Create them with vault token create orphan.

Discover how the cubbyhole secret engine provides token-scoped private storage where only the issuing token can read its data; secrets are destroyed when the token expires.

Learn how response wrapping secures vault access with a wrapping token, unwrap to retrieve the secret ID, and fetch secrets via a role ID.

Explore batch tokens in vault, compare badge tokens and service tokens, and learn how batch tokens are lightweight, require no disk storage, and support policies for token creation and authentication.

Explore how Vault's token time-to-live configurations control non-root token lifespans, including default and maximum TTLs, mount tuning, and per-authentication-method TTL overrides.

Explore how periodic tokens offer effectively unlimited lifetimes through renewal, unlike standard tokens with limited TTLs. Learn how to create and renew periodic tokens, and why service renewal matters.

Learn how to deploy vault in production by selecting a storage backend (file system, S3, console, databases like MySQL, DynamoDB, PostgreSQL), creating config files, initializing, unsealing, and securing with TLS.

Enable the vault GUI for production by setting UI to true in the config, expose port 8200, and unseal to access the GUI.

Demonstrates vault agent caching, showing client-side token and lease caching to reduce vault server calls. Explains cache and listener configurations and the token flow for apps and EC2 users.

Vault uses Shamir's secret sharing to split the master key into five shares, requiring any three to reconstruct and unseal. A sealed stanza enables protection via hsm or cloud kms.

Discover how vault auto unseal shifts unsealing from users to a trusted device or service, decrypting the master key via AWS KMS and other options at startup.

Configure vault auto unseal with aws kms by creating a symmetric key and iam user. Provide region, access key, secret key, and key id, then initialize vault and observe unseal.

Enable and use audit devices in vault to log every request and response, including errors, by configuring a file audit device and reviewing the JSON-formatted logs.

Explore Vault Enterprise, highlighting disaster recovery, namespaces, monitoring, multifactor authentication, and auto seal with HSM, and compare it to open source while noting the 30-day trial.

Learn how Vault namespaces in Vault Enterprise isolate teams with dedicated policies, authentication methods, secret engines, tokens, identities, and groups—vault within a vault for secure, independent workloads.

Explore vault replication at a high level, comparing performance replication and disaster recovery replication between primary and secondary clusters, including tokens, leases, and shared secrets.

Learn how vault telemetry collects metrics and audit logs, pushes them to Splunk or Prometheus via fluentd, and exposes data through the CIS matrix endpoint in json or Prometheus formats.

Implement high availability in Vault using the integrated raft storage across three nodes, configure node identities, initialize and unseal, and manage leadership with raft status, failover, and step down.

Master vault raft snapshot operations to back up and restore data using the save and restore commands, and verify recovery with key operations and a demo dot snap.

Explore vault policies, default and root policies, token accessors, and token capabilities, and learn how to enable and disable authentication methods for secure access.

Identify Vault backends supported by HashiCorp technical support, including in-memory, file system, console, and raft, and note enterprise features like disaster recovery, namespaces, and auto unseal with KMS.

Explore path templating with identity dot entity dot name and the difference between service and batch tokens, plus core vault concepts like default policies and token management.

Master transit engine tips for encrypting large data with a local data key and understand Vault policies, key rotation, minimum decrypt version, and high availability basics.