Advanced secrets management with Vault
You run Vault with policies, dynamic database credentials, an internal certificate authority and audit logs, so that apps work with short-lived credentials.
Level 301 · 18 lessons · 15 practice labs
Lessons
How Vault works
- Sealing, unsealing and the storage backend
- Auth methods: token, AppRole, username
- Policies: paths and capabilities
- Token lifecycle: TTL, renewal and revocation
- Short task: write the narrowest policy for one service
Dynamic secrets
- KV versions and rollback
- The database engine: a user per request
- Leases and bulk revocation
- The transit engine: encrypting data outside the app
- Short task: give a report job a one-hour database user
Certificates and applications
- The PKI engine: an internal certificate authority
- Short-lived certificates and automatic renewal
- Delivering secrets to apps with Vault Agent
- CI jobs accessing Vault
- Short task: render a service’s config with a Vault Agent template
Auditing and operations
- Audit devices and reading their logs
- Break-glass access and root token handling
- Capstone: move an app from static passwords to dynamic credentials
Practice labs
- Read Vault’s seal status and storage backend: Write the seal state, key threshold and storage type from vault status output.
- Write the narrowest policy for one service: Write a policy letting the service read only its own path, bind it with AppRole and show access to another path is denied.
- Narrow over-broad policies using the audit log: Extract from the audit log the paths a service on a wildcard policy really uses, reduce the policy to those and confirm no outage.
- Look up a token’s lifetime and policies: Show the token’s remaining TTL, whether it is renewable and its attached policies.
- Replace non-expiring tokens with short-lived ones: Find a service token issued without expiry, set the role’s maximum TTL and show renewal and revocation work.
- Revoke leases in bulk during a leak: Revoke by prefix every token and dynamic credential issued under a leaked role and prove other services are unaffected.
- List KV versions and roll back to an earlier value: Show the version history of a secret overwritten by mistake and restore the previous version.
- Give a report job a one-hour database user: Define a read-only role in the database engine and show the job gets a fresh user each run that is removed when the lease ends.
- Encrypt data outside the app with the transit engine and rotate the key: Move the app’s field encryption to transit calls, rotate the key, rewrap old records and raise the minimum decryption version.
- Request a certificate from the PKI engine: Obtain a certificate for a service name from the internal certificate authority and read its validity period.
- Render a service’s config with a Vault Agent template: Set the Agent up to authenticate automatically, render the config file from a template and show it refreshes when the secret changes.
- Set up automatic renewal of short-lived certificates: Have the Agent renew a 24-hour certificate, reload the service without downtime and verify a CI job reaches Vault with a narrow permission.
- Enable an audit device and find one request in the log: Enable the file audit device, perform a read and find the path and identity in its record.
- Work out from the audit log who accessed what: Use jq to summarise the identities that accessed the production path in the last day and the denied requests.
- Move an app to dynamic credentials and define break-glass access: Carry out the migration without downtime, revoke the root token, write the break-glass steps and show in a drill that a root token is regenerated and revoked.
About this course
You run Vault with policies, dynamic database credentials, an internal certificate authority and audit logs, so that apps work with short-lived credentials.
What you will learn
- How Vault works
- Dynamic secrets
- Certificates and applications
- Auditing and operations
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.