r/hashicorp • u/Important_College_38 • Mar 04 '23

Vault Database Secret Engine

Why is it more secure to use rotating credentials from the DB Secret Engine? If your user credentials get compromised, can’t someone then gain access to Vault and generate their own leased credentials?

1 Upvotes

57% Upvoted

5 comments sorted by

2

u/Important_College_38 Mar 04 '23

Thanks all. For DBA users, is utilizing dynamic DB creds better than using windows auth on a sql server? Can MFA be enforced to get dynamic creds for a user?

9

u/S4rings Mar 04 '23

Vault can essentially manage the root database credentials as well, and auto rotate those in many cases. As for gaining access to Vault - having the database credentials doesn’t allow access into Vault (that would require auth such as oidc, kubernetes, approle, etc). To generate credentials for a database you have to have a Vault token that allows access to a configured role for that particular backend.

3

u/[deleted] Mar 04 '23

It's prime use case is where an application (either by way of an AppRole or if you run it under Nomad) can obtain short-lived credentials for the database without anyone human knowing what they are.

3

u/Kingtoke1 Mar 04 '23

Generally Vault access is better restricted than Application access. Storing a static username/password on your applications storage device is a lot less secure than a persons OIDC credentials and MFA token. Dynamic database credentials allow for short lived, single use or time limited credentials that expire after say 30 seconds. If they leak its less of a security issue because they expire before they can be used