Secrets Management with Vault

Prerequisites: Docker installed (to run Vault and a throwaway PostgreSQL instance), the Vault CLI installed, and basic familiarity with environment variables.

Every environment variable holding a database password is a secret that never expires, is copyable by anything with read access to the process environment, and has to be manually rotated by a human who remembers to do it. Vault's core value proposition is replacing long-lived static secrets with short-lived, automatically-expiring ones — and centralizing access control and audit logging for whatever secrets do have to stay static.

You'll run Vault in dev mode (fine for learning, never for production — dev mode stores everything in memory and unseals automatically), store a static secret, then build the more interesting piece: dynamic secrets, where Vault creates a brand-new, time-limited database user on demand and automatically revokes it when the lease expires. This is the pattern that eliminates "shared database password that everyone has and nobody rotates" as a category of risk entirely.