[ejcx]

I almost never heard anything negative about vault until I did a presentation on all the troubles I had with it. Here are the slides about the issues I had:

https://docs.google.com/presentation/d/1ipP2eB9pW5j3WDvzCGz9...

At the end of the day, Vault gives you secret keys to manage which makes automating the unsealing process not fun if you want full automation.

Talking with Armon from Hashicorp they planned to work on some much improved docs around vault which should help with a lot of the issues of making vault usable, because quite frankly they are very challenging to understand right now.

[lolbrish]

I unseal using ansible (with the unseal keys in ansible-vault) and automate the configuration fully through ansible. For example you can use the ansible expect module:

  - name: unseal 1
    expect:
      command: '/usr/bin/vault unseal'
      responses:
        'Key \(will be hidden\): ': "{{vault_seal_key_1}}"
      echo: yes
    when: vault_sealed_result.rc == 2 and vault_seal_key_1 is defined
    tags:
      unseal

[bogomipz]

I'm interested in your solution, you are using ansible-vault to store the Hashicorp Vault unseal key(s)? Isn't this just pushing the problem out another level or am I missing something? Thanks.

[jaxxstorm]

I wrote a tool to ease this: https://github.com/jaxxstorm/unseal it's not perfect, but it makes the process much, much easier

[redwolfb14]

I read this presentation a little while ago and I felt it was slightly disingenuous. Many of the "problems" are process related and have nothing to do with vault itself. Then your approach is using ParameterStore which provides a UI and is built on the AWS ecosystem proper which I guess works if you are sticking to only AWS. I guess it comes down to how you view "secrets" but i'd rather that be spelled out than suggesting hard to automate and not easy to work with.

[bogomipz]

Thanks for sharing. Was your talk recorded by any chance? I would be interested in watching it.

[scrollaway]

aws-vault and chamber both look fantastic. When was the talk given? Has the situation improved since? Would you still recommend both those tools over Hashicorp Vault?