Secrets Management: Moving Beyond .env Files with HashiCorp Vault

2026-04-02 1 min read #Infrastructure as Code (Terraform) | PK Pramod Krishna

If your database password is in a .env file or a GitHub Secret, you have a "static secret" problem. If that secret is leaked, it’s valid until someone manually rotates it. As an architect, I advocate for Dynamic Secrets.

1. The Vault Workflow

Instead of your application "knowing" the password, it authenticates with Vault using its IAM role (on AWS) or ServiceAccount (on Kubernetes). Vault then generates a time-limited credential.

2. Implementation: AWS IAM Auth

# Policy for the Application
path "database/creds/readonly" {
  capabilities = ["read"]
}

The application then performs a login:

App sends its signed AWS Identity document to Vault.
Vault verifies the identity with AWS STS.
Vault returns a token with a 1-hour TTL.

3. Troubleshooting: Token Revocation

One major benefit is the "Nuclear Option." If you detect an intrusion, you can revoke all tokens for a specific path instantly without changing the master database password. This drastically reduces the "Blast Radius" of a security event.

Continue Reading

#Infrastructure as Code (Terraform) 2026-03-21

Infrastructure as Code: Why I Switched from CloudFormation to Terraform

An architectural deep-dive into state management, provider ecosystems, and the "Day 2" operations that make Terraform superior for multi-cloud environments.

Read post ->

#DevOps 2026-09-10

S3 + CloudFront vs Nginx + Docker: Where Should You Host a React App?

If a React application becomes static files after npm run build, why do teams still package it inside Docker and serve it through Nginx? Let's compare S3 + CloudFront with Nginx + Docker and understand when each architecture makes sense.

Read post ->

#Frontend 2026-09-06

Why Do We Build React Apps for Production Instead of Running npm run dev?

Have you ever wondered why we run npm run build before deploying a React application instead of simply running npm run dev on the production server? Let's understand what actually happens behind the scenes.

Read post ->