HashiCorp Vault

HashiCorp Vault is a tool for securely accessing secrets: API keys, passwords, certificates and anything else you want to tightly control. It gives every secret one interface, with tight access control and a detailed audit log of who accessed what. You can run it yourself or use HashiCorp's hosted version.

Vault encrypts data before writing it to storage, so access to the raw storage isn't enough to read secrets. It can generate dynamic secrets on demand, such as short-lived AWS or database credentials, and revoke them automatically. It also provides encryption as a service, leases and renewal for every secret, and revocation of single secrets or whole trees of them.

Vault is the most widely used way to keep secrets out of code and config files, and to hand out short-lived credentials instead of permanent ones. Its license changed in 2023, explained below.

Vault 1.15 and later use the Business Source License (BSL 1.1). You can use it in production, including commercially, but you can't offer it to others as a hosted or embedded product that competes with HashiCorp's paid versions. Because of that it isn't open source in the strict sense. OpenBao is an open-source fork of Vault under the MPL 2.0 license.

Stars

0

Forks

0

Commits

0

Repository

hashicorp/vault

• AWS Secrets ManagerAmazon's hosted secrets management service.
• DDopplerHosted secrets management platform for teams.
• InfisicalNo. 196Open-source secrets management platform.

See every open-source alternative to Doppler in the collection.