Challenge 45 ☆☆☆☆

Welcome to challenge Challenge 45.

Vault subkey challenge

Sometimes, all you want to do is have that concise entry in your secrets management system. So, what about storing your username and password in the same entry? We tried doing that but got into a new problem! With Hashicorp Vault, you can set up policies to allow access to a subkey (Which is the key to the value of your secret). Can you find the very random username we set up for this challenge?

💡 Tip: Secrets are often strings, numbers, or encoded values. Copy and paste exactly what you find.

Why putting sensitive data as keys is a bad idea

Sometimes, people reason that less sensitive data should be stored as a subkey of the actual secret. That way, both a username and a password, for instance, can be combined in a single entry. In many cases, these secrets are equally important and should get equal protection as the secret (e.g. the password) itself. And in Vault’s case, you can access a subkey (E.g., the username), but not the secret value itself (e.g., the password), which would already leak the username.

We often don’t want to give read access to secrets to our employees, but we do want to provide read access to subkeys instead. If any secret is stored in the subkeys, that secret is then compromised internally.


⬅️ Previous
🏠 Main Page
Next ➡️
0