vault

Best Practices

• Use Raft integrated storage for production high-availability clusters
• Enable TLS on all listeners with valid certificates
• Use auto-unseal (AWS KMS, Azure Key Vault, Transit) instead of Shamir keys in production
• Follow least-privilege principle in ACL policies — deny by default
• Enable audit logging on at least two backends for tamper evidence
• Use KV v2 (versioned) over v1 for secret engines
• Rotate encryption keys and credentials on a regular schedule
• Use AppRole or Kubernetes auth for machine-to-machine authentication
• Set max_lease_ttl and default_lease_ttl appropriate to the use case
• Configure telemetry for Prometheus or StatsD monitoring
• Namespace secret paths by environment and application
• Use response wrapping for initial secret distribution

Documentation Sources