vault

Best Practices

• Use least-privilege policies with explicit path-based access control
• Enable audit logging for all Vault operations
• Configure auto-unseal using cloud KMS (AWS KMS, GCP KMS, Azure Key Vault)
• Use namespaces for multi-tenant isolation in enterprise
• Set appropriate default and max TTLs for secrets and tokens
• Enable TLS for all listener endpoints
• Use integrated storage (Raft) for production deployments
• Always use least-privilege access with explicit deny where needed
• Never grant root or sudo capabilities in application policies
• Use path wildcards carefully — prefer explicit paths over broad globs
• Include token self-management paths for operational use
• Separate policies by team or service for clear access boundaries

Documentation Sources