Skip to main content
Solutions

Database Credential Rotation

Reduce the risk of breaches and credential leakage

zero trust

Your Challenge

Each database in your organization requires credentials for access. These passwords are used by applications, services, and users.

Safeguarding credentials — and mitigating the risk from leaked credentials — is a complex problem. But it’s an important one: leaked credentials can leave your organization open to costly breaches and a loss of trust.

HashiCorp Vault can help you to overcome this problem by easily allowing you to create, rotate, and revoke database credentials through an automated workflow and API.

Automate credential rotation

HashiCorp Vault enables organizations to automatically rotate passwords for existing database users, applications, and services. Easily integrate existing applications with Vault, and improve secrets management.

HashiCorp products used
  • Improve securityReduce risk of breaches and credential leakage to ensure security of your networks, infrastructure, and data.
  • Automate manual processesEliminate manual systems through automated processes to ensure information is secure and credentials only exist as long as necessary, limiting the window for a breach.
  • Gain faster, more efficient auditingIncrease visibility into credential systems through detailed audit trails and logs to ensure and evaluate security posture.
  • SVG petco.svg
  • Ubisoft
  • anaplan.svg
  • Elvia
  • vinid.svg
  • ABN AMRO logo
  • athenahealth.svg
  • bcp
  • Github logo
  • SVG petco.svg
  • Ubisoft
  • anaplan.svg
  • Elvia
  • vinid.svg
  • ABN AMRO logo
  • athenahealth.svg
  • bcp
  • Github logo
Hear Vault success stories

"Vault was the solution for our business problem...Kubernetes that needed to connect to external services with credentials."

Diego Braga, Banco Popolare

Automate credential rotation to increase security and compliance

Secrets as a Service

The Vault database secrets engine​​​​‌‍​‍​‍‌‍‌​‍‌‍‍‌‌‍‌‌‍‍‌‌‍‍​‍​‍​‍‍​‍​‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍​‍​‍​​‍​‍‌‍‍​‌​‍‌‍‌‌‌‍‌‍​‍​‍​‍‍​‍​‍‌‍‍​‌‌​‌‌​‌​​‌​​‍‍​‍​‍‌‍‍​‌‍​‌‌​‌‍‍​‌‍‍‌‌‍​‌‍‌​‍‌​​​‍‍‌‍​‌‌‍‌​‌‍‌‌‍‍‌‌‍‍​‍‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​‌‍‌​‍​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌‌‌‌​‌‍‌‌​​‌‍‌‌‌​​‍‌‍​‍​‍​‌‌‍‍‌‌​‍​‌‌‌‍‌​‌​​‌​​‌‌‌​‌​‌‌‍​‌​‌‌‌​‌‌‍‌‍‌‌​‌‌‌‌‍‌‍‌‌‌‍‌‍‌‌‌‌‌‌​‌‌‍‌​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌​​‍‌‌‍​‌‌​‌​‌‌‌‍‌‌​‌​‌‌‌​‍​‌‌‌‌​‌‌​‌​‌‍‌‌‌​‍‌‍‍‌‍‌‍‌‍​‌‌​‌‌‌​​​‍‌‍​‌​‌​‌‍‌‌‌‌​‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​​‍​‌‍‌‍‌‍‍‌‌‍‌‌‌‍​‌‍‌​‌‌​​‌‍​‌‌‌​‌‍‍​​‌‌‍​‌‍‌‍‍‌‌​‌‍‌‌‌‍‍‌‌​​‍‍​‌‍​‍‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​‌‍‌​‍‌‍‍‌‌‍​‌‌‍​‌‌‌‍​‍‌‍​‌‍‌‍​‌‍‍‌​​‍‍​​​​‍‍‌‍‌​‌‍‌‌‌​‌‍​‌​‍‌‍‍‌‌​​‌‌​‌‍‍‌‌‍‌‍‍​‍​‍‌‌ generates credentials dynamically based on configured roles. It is able to work with any combination of different databases leveraging a plugin interface, robust built-in database types, and frameworks that enable the running of custom database types. Services that need access no longer need to hardcode credentials: they can request them from Vault and use Vault's leasing mechanism to easily roll keys, creating dynamic secrets.

  • Services access databases with unique credentials, making auditing much easier.

  • Vault's internal revocation system ensures that users become invalid after a set time.

 credential-rotation_graphic1.png

Dynamic secrets rotation and revocation

Applications “ask” Vault for database credentials rather than setting them as environment variables. Administrators specify the time-to-live (TTL) for database credentials so that they are automatically revoked when no longer used.​​​​‌‍​‍​‍‌‍‌​‍‌‍‍‌‌‍‌‌‍‍‌‌‍‍​‍​‍​‍‍​‍​‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍​‍​‍​​‍​‍‌‍‍​‌​‍‌‍‌‌‌‍‌‍​‍​‍​‍‍​‍​‍‌‍‍​‌‌​‌‌​‌​​‌​​‍‍​‍​‍‌‍‍​‌‍​‌‌​‌‍‍​‌‍‍‌‌‍​‌‍‌​‍‌​​​‍‍‌‍​‌‌‍‌​‌‍‌‌‍‍‌‌‍‍​‍‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​‌‍‌​‍​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌‌‌‌​‌‍‌‌​​‌‍‌‌‌​​‍‌‍​‍​‍​‌‌‍‍‌‌​‍​‌‌‌‍‌​‌​​‌​​‌‌‌​‌​‌‌‍​‌​‌‌‌​‌‌‍‌‍‌‌​‌‌‌‌‍‌‍‌‌‌‍‌‍‌‌‌‌‌‌​‌‌‍‌​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌​​‍‌‌‍​‌‌​‌​‌‌‌‍‌‌​‌​‌‌‌​‍​‌‌‌‌​‌‌​‌​‌‍‌‌‌​‍‌‍‍‌‍‌‍‌‍​‌‌​‌‌‌​​​‍‌‍​‌​‌​‌‍‌‌‌‌​‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​​‍​‌‍‌‍‌‍‍‌‌‍‌‌‌‍​‌‍‌​‌‌​​‌‍​‌‌‌​‌‍‍​​‌‌‍​‌‍‌‍‍‌‌​‌‍‌‌‌‍‍‌‌​​‍‍​‌‍​‍‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​‌‍‌​‍‌‍‍‌‌‍​‌‌‍​‌‌‌‍​‍‌‍​‌‍‌‍​‌‍‍‌​​‍‍​​‌​‍‍‌‍‌​‌‍‌‌‌​‌‍​‌​‍‌‍‍‌‌​​‌‌​‌‍‍‌‌‍‌‍‍​‍​‍‌‌

  • Each app instance can get unique credentials that don't have to be shared and are short-lived.  

  • Using dynamic secrets reduces the chance they become compromised, and should that happen, individual secrets can be revoked rather than requiring global changes.

credential-rotation_graphic2.png

Database credential automation

Vault's database secrets engine provides a centralized workflow to automatically manage credentials for various database systems. Every service instance gets a unique set of credentials that live only for the life of that service. This also means that abnormal access patterns can be pinpointed to a specific service instance and its credential can be revoked immediately.  ​​​​‌‍​‍​‍‌‍‌​‍‌‍‍‌‌‍‌‌‍‍‌‌‍‍​‍​‍​‍‍​‍​‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍​‍​‍​​‍​‍‌‍‍​‌​‍‌‍‌‌‌‍‌‍​‍​‍​‍‍​‍​‍‌‍‍​‌‌​‌‌​‌​​‌​​‍‍​‍​‍‌‍‍​‌‍​‌‌​‌‍‍​‌‍‍‌‌‍​‌‍‌​‍‌​​​‍‍‌‍​‌‌‍‌​‌‍‌‌‍‍‌‌‍‍​‍‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​‌‍‌​‍​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌‌‌‌​‌‍‌‌​​‌‍‌‌‌​​‍‌‍​‍​‍​‌‌‍‍‌‌​‍​‌‌‌‍‌​‌​​‌​​‌‌‌​‌​‌‌‍​‌​‌‌‌​‌‌‍‌‍‌‌​‌‌‌‌‍‌‍‌‌‌‍‌‍‌‌‌‌‌‌​‌‌‍‌​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌​​‍‌‌‍​‌‌​‌​‌‌‌‍‌‌​‌​‌‌‌​‍​‌‌‌‌​‌‌​‌​‌‍‌‌‌​‍‌‍‍‌‍‌‍‌‍​‌‌​‌‌‌​​​‍‌‍​‌​‌​‌‍‌‌‌‌​‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​​‍​‌‍‌‍‌‍‍‌‌‍‌‌‌‍​‌‍‌​‌‌​​‌‍​‌‌‌​‌‍‍​​‌‌‍​‌‍‌‍‍‌‌​‌‍‌‌‌‍‍‌‌​​‍‍​‌‍​‍‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​‌‍‌​‍‌‍‍‌‌‍​‌‌‍​‌‌‌‍​‍‌‍​‌‍‌‍​‌‍‍‌​​‍‍​​‍​‍‍‌‍‌​‌‍‌‌‌​‌‍​‌​‍‌‍‍‌‌​​‌‌​‌‍‍‌‌‍‌‍‍​‍​‍‌‌

  • Policies and automated tasks reduce the need for manual tasks by database administrators, making database access and updates more efficient and secure.

  • Automated credential rotation maintains security and access to your information while reducing downtime.

 credential-rotation_graphic3.png

Learn from your peers

  • BCP
    Taming application secrets at BPS with HashiCorp Vault​​​​‌‍​‍​‍‌‍‌​‍‌‍‍‌‌‍‌‌‍‍‌‌‍‍​‍​‍​‍‍​‍​‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍​‍​‍​​‍​‍‌‍‍​‌​‍‌‍‌‌‌‍‌‍​‍​‍​‍‍​‍​‍‌‍‍​‌‌​‌‌​‌​​‌​​‍‍​‍​‍‌‍‍​‌‍​‌‌​‌‍‍​‌‍‍‌‌‍​‌‍‌​‍‌​​​‍‍‌‍​‌‌‍‌​‌‍‌‌‍‍‌‌‍‍​‍‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​‌‍‌​‍​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌‌‌‌​‌‍‌‌​​‌‍‌‌‌​​‍‌‍​‍​‍​‌‌‍‍‌‌​‍​‌‌‌‍‌​‌​​‌​​‌‌‌​‌​‌‌‍​‌​‌‌‌​‌‌‍‌‍‌‌​‌‌‌‌‍‌‍‌‌‌‍‌‍‌‌‌‌‌‌​‌‌‍‌​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌​​‍‌‌‍​‌‌​‌​‌‌‌‍‌‌​‌​‌‌‌​‍​‌‌‌‌​‌‌​‌​‌‍‌‌‌​‍‌‍‍‌‍‌‍‌‍​‌‌​‌‌‌​​​‍‌‍​‌​‌​‌‍‌‌‌‌​‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​​‍​‌‍‌‍‌‍‍‌‌‍‌‌‌‍​‌‍‌​‌‌​​‌‍​‌‌‌​‌‍‍​​‌‌‍​‌‍‌‍‍‌‌​‌‍‌‌‌‍‍‌‌​​‍‍​‍​​‍‍‌‍​‌‍​‌‌​‍‌‍‌​‌​​‍‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌​​‍‍​​​​‍‍‌‍‍​‌‍‌‌‌‍​‌‌‍‌​‌‍‍‌‌‍‍‌‍‌​‍​‍‌‌Learn how Vault is helping Banca Popolare journey through the long-standing challenge of dealing with secrets in application architectures.​​​​‌‍​‍​‍‌‍‌​‍‌‍‍‌‌‍‌‌‍‍‌‌‍‍​‍​‍​‍‍​‍​‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍​‍​‍​​‍​‍‌‍‍​‌​‍‌‍‌‌‌‍‌‍​‍​‍​‍‍​‍​‍‌‍‍​‌‌​‌‌​‌​​‌​​‍‍​‍​‍‌‍‍​‌‍​‌‌​‌‍‍​‌‍‍‌‌‍​‌‍‌​‍‌​​​‍‍‌‍​‌‌‍‌​‌‍‌‌‍‍‌‌‍‍​‍‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​‌‍‌​‍​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌‌‌‌​‌‍‌‌​​‌‍‌‌‌​​‍‌‍​‍​‍​‌‌‍‍‌‌​‍​‌‌‌‍‌​‌​​‌​​‌‌‌​‌​‌‌‍​‌​‌‌‌​‌‌‍‌‍‌‌​‌‌‌‌‍‌‍‌‌‌‍‌‍‌‌‌‌‌‌​‌‌‍‌​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌​​‍‌‌‍​‌‌​‌​‌‌‌‍‌‌​‌​‌‌‌​‍​‌‌‌‌​‌‌​‌​‌‍‌‌‌​‍‌‍‍‌‍‌‍‌‍​‌‌​‌‌‌​​​‍‌‍​‌​‌​‌‍‌‌‌‌​‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​​‍​‌‍‌‍‌‍‍‌‌‍‌‌‌‍​‌‍‌​‌‌​​‌‍​‌‌‌​‌‍‍​​‌‌‍​‌‍‌‍‍‌‌​‌‍‌‌‌‍‍‌‌​​‍‍​‍​​‍‍‌‍​‌‍​‌‌​‍‌‍‌​‌​​‍‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌​​‍‍​​​​‍‍‌‍‌​‌‍‌‌‌​‌‍​‌​‍‌‍‍‌‌​​‌‌​‌‍‍‌‌‍‌‍‍​‍​‍‌‌
  • Cracking the code to global success‌‍​‍​‍‌‍‌​‍‌‍‍‌‌‍‌‌‍‍‌‌‍‍​‍​‍​‍‍​‍​‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍​‍​‍​​‍​‍‌‍‍​‌​‍‌‍‌‌‌‍‌‍​‍​‍​‍‍​‍​‍‌‍‍​‌‌​‌‌​‌​​‌​​‍‍​‍​‍‌‍‍​‌‍​‌‌​‌‍‍​‌‍‍‌‌‍​‌‍‌​‍‌​​​‍‍‌‍​‌‌‍‌​‌‍‌‌‍‍‌‌‍‍​‍‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​‌‍‌​‍​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌‌‌‌​‌‍‌‌​​‌‍‌‌‌​​‍‌‍​‍​‍​‌‌‍‍‌‌​‍​‌‌‌‍‌​‌​​‌​​‌‌‌​‌​‌‌‍​‌​‌‌‌​‌‌‍‌‍‌‌​‌‌‌‌‍‌‍‌‌‌‍‌‍‌‌‌‌‌‌​‌‌‍‌​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌​​‍‌‌‍​‌‌​‌​‌‌‌‍‌‌​‌​‌‌‌​‍​‌‌‌‌​‌‌​‌​‌‍‌‌‌​‍‌‍‍‌‍‌‍‌‍​‌‌​‌‌‌​​​‍‌‍​‌​‌​‌‍‌‌‌‌​‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​​‍​‌‍‌‍‌‍‍‌‌‍‌‌‌‍​‌‍‌​‌‌​​‌‍​‌‌‌​‌‍‍​​‌‌‍​‌‍‌‍‍‌‌​‌‍‌‌‌‍‍‌‌​​‍‍​‍​​‍‍‌‍​‌‍​‌‌​‍‌‍‌​‌​​‍‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌​​‍‍​​​​‍‍‌‍‍​‌‍‌‌‌‍​‌‌‍‌​‌‍‍‌‌‍‍‌‍‌​‍​‍‌‌Learn how GitHub uses HashiCorp solutions to shore up internal processes and deliver mission-critical functionality faster and at lower cost.
  • Securing 10 million personalized promotions‌‍​‍​‍‌‍‌​‍‌‍‍‌‌‍‌‌‍‍‌‌‍‍​‍​‍​‍‍​‍​‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍​‍​‍​​‍​‍‌‍‍​‌​‍‌‍‌‌‌‍‌‍​‍​‍​‍‍​‍​‍‌‍‍​‌‌​‌‌​‌​​‌​​‍‍​‍​‍‌‍‍​‌‍​‌‌​‌‍‍​‌‍‍‌‌‍​‌‍‌​‍‌​​​‍‍‌‍​‌‌‍‌​‌‍‌‌‍‍‌‌‍‍​‍‍‌‍‌​‌‍​‌‌‌​‌‍‌‍​‌‍‌‌​​‍‍‌‍​‌‍‌‍‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​‌‍‌​‍​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌‌‌‌​‌‍‌‌​​‌‍‌‌‌​​‍‌‍​‍​‍​‌‌‍‍‌‌​‍​‌‌‌‍‌​‌​​‌​​‌‌‌​‌​‌‌‍​‌​‌‌‌​‌‌‍‌‍‌‌​‌‌‌‌‍‌‍‌‌‌‍‌‍‌‌‌‌‌‌​‌‌‍‌​‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌​​‍‌‌‍​‌‌​‌​‌‌‌‍‌‌​‌​‌‌‌​‍​‌‌‌‌​‌‌​‌​‌‍‌‌‌​‍‌‍‍‌‍‌‍‌‍​‌‌​‌‌‌​​​‍‌‍​‌​‌​‌‍‌‌‌‌​‌​‍‌‍‌‌‌‍‌​‌‍‍‌‌‌​​‍​‌‍‌‍‌‍‍‌‌‍‌‌‌‍​‌‍‌​‌‌​​‌‍​‌‌‌​‌‍‍​​‌‌‍​‌‍‌‍‍‌‌​‌‍‌‌‌‍‍‌‌​​‍‍​‍​​‍‍‌‍​‌‍​‌‌​‍‌‍‌​‌​​‍‍‌‍‍‌‌‌​‌‍‌‌‌‍‌‌​​‍‍​​​​‍‍‌‍‍​‌‍‌‌‌‍​‌‌‍‌​‌‍‍‌‌‍‍‌‍‌​‍​‍‌‌Learn how Vietnamese consumer retail app provider uses HashiCorp Vault to automate secrets management and reduce time required to protect sensitive data by 90%.

Keep It Secret. Keep It Safe. Keep It Everywhere.

Adobe has been running Vault Enterprise in production for two years and now the platform services over 130 teams. Learn about all of the best practices and pitfalls of using Vault from this large-scale use case.

Explore our resources

Take the next step

See how HashiCorp Vault can help you with all aspects of credential rotation and improve the security posture of your infastructure