We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Security Architecture
Free preview: the first 2 parts of this 6-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Security Architecture
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
A cloud secrets manager stores and retrieves static secrets. But what happens when you need database credentials that are unique per application instance and auto-expire after 1 hour? Or encryption as a service where applications can encrypt and decrypt data without ever touching encryption keys? Or a system that works across AWS, GCP, and on-premise simultaneously?
HashiCorp Vault is the most widely adopted vault system. Over 100 million downloads. Used by Stripe for encrypting payment data at rest (Transit engine). Used by Cloudflare for managing TLS certificates across their 310+ data centers (PKI engine). Used by Adobe for dynamic database credentials across their multi-cloud infrastructure.
Vault goes beyond simple secret storage. It is a security infrastructure platform. Applications do not manage their own credentials or encryption. They call Vault.
| Engine | What It Does | Example | |
|---|---|---|---|
| KV (Key-Value) | Store and retrieve static secrets with versioning | API keys, config values | No expiry (static) |
| Database | Generate dynamic DB credentials on demand | Unique Postgres user per app instance | 1 hour default |
| Transit | Encryption as a service. Keys never leave Vault | Encrypt PII before storing in DB | N/A |
| PKI | Issue and manage TLS certificates | Internal mTLS cert automation | 24 hours to 90 days |
| SSH | Issue short-lived SSH credentials | SSH access to production for 30 minutes | Minutes to hours |
| AWS/GCP/Azure | Generate cloud provider credentials dynamically | Temporary IAM credentials per deployment | Minutes to hours |
| TOTP | Generate time-based one-time passwords | MFA codes for service accounts | 30 seconds |
Dynamic database credentials in practice:
v-k8s-myapp-abc123 with SELECT, INSERT, UPDATE on the orders schema only. TTL: 1 hourDROP ROLE v-k8s-myapp-abc123 on PostgresIf those credentials leak, the attacker has at most 1 hour. And the credentials only have the minimum permissions the app needs, no DROP TABLE, no CREATE ROLE, no access to other schemas.
Transit engine eliminates application-level encryption complexity. Your app calls POST /v1/transit/encrypt/payment-data with the plaintext. Vault encrypts it with a key that never leaves Vault's memory and returns the ciphertext. To decrypt, call the decrypt endpoint. Your application code never imports a crypto library, never generates a key, never handles key rotation. Vault manages all of it.