.

security/secrets/hashicorp-vault/references/secrets-engines.md

@@ -0,0 +1,136 @@
+# Vault Secrets Engines Guide
+
+## KV Secrets Engine (v2)
+
+### Enable and Configure
+```bash
+# Enable KV v2
+vault secrets enable -path=secret kv-v2
+
+# Write secret
+vault kv put secret/myapp/config \
+    db_host="postgres.example.com" \
+    db_user="myapp" \
+    db_password="secret123"
+
+# Read secret
+vault kv get secret/myapp/config
+vault kv get -field=db_password secret/myapp/config
+
+# List secrets
+vault kv list secret/myapp/
+
+# Delete secret
+vault kv delete secret/myapp/config
+
+# Versioning
+vault kv get -version=1 secret/myapp/config
+vault kv rollback -version=1 secret/myapp/config
+```
+
+## Database Secrets Engine
+
+### Setup Dynamic Credentials
+```bash
+# Enable database engine
+vault secrets enable database
+
+# Configure PostgreSQL
+vault write database/config/myapp-db \
+    plugin_name=postgresql-database-plugin \
+    allowed_roles="myapp-role" \
+    connection_url="postgresql://{{username}}:{{password}}@postgres:5432/myapp?sslmode=disable" \
+    username="vault_admin" \
+    password="admin_password"
+
+# Create role
+vault write database/roles/myapp-role \
+    db_name=myapp-db \
+    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
+        GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
+    default_ttl="1h" \
+    max_ttl="24h"
+
+# Generate credentials
+vault read database/creds/myapp-role
+```
+
+## AWS Secrets Engine
+
+### Setup Dynamic AWS Credentials
+```bash
+# Enable AWS engine
+vault secrets enable aws
+
+# Configure root credentials
+vault write aws/config/root \
+    access_key=AKIAXXXXXXXX \
+    secret_key=xxxxxxxx \
+    region=us-east-1
+
+# Create role
+vault write aws/roles/deploy-role \
+    credential_type=iam_user \
+    policy_document=-<<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:*"],
+      "Resource": ["arn:aws:s3:::my-bucket/*"]
+    }
+  ]
+}
+EOF
+
+# Generate credentials
+vault read aws/creds/deploy-role
+```
+
+## PKI Secrets Engine
+
+### Certificate Authority
+```bash
+# Enable PKI
+vault secrets enable pki
+vault secrets tune -max-lease-ttl=87600h pki
+
+# Generate root CA
+vault write pki/root/generate/internal \
+    common_name="Example Root CA" \
+    ttl=87600h
+
+# Create role
+vault write pki/roles/server-cert \
+    allowed_domains="example.com" \
+    allow_subdomains=true \
+    max_ttl="720h"
+
+# Issue certificate
+vault write pki/issue/server-cert \
+    common_name="api.example.com" \
+    ttl="24h"
+```
+
+## Transit Secrets Engine
+
+### Encryption as a Service
+```bash
+# Enable transit
+vault secrets enable transit
+
+# Create encryption key
+vault write -f transit/keys/myapp-key
+
+# Encrypt data
+vault write transit/encrypt/myapp-key \
+    plaintext=$(echo "secret data" | base64)
+
+# Decrypt data
+vault write transit/decrypt/myapp-key \
+    ciphertext="vault:v1:xxxxx"
+
+# Rotate key
+vault write -f transit/keys/myapp-key/rotate
+```

security/secrets/hashicorp-vault/references/vault-policies.md

@@ -0,0 +1,130 @@
+# Vault Policy Guide
+
+## Policy Syntax
+
+```hcl
+# Basic policy structure
+path "secret/data/myapp/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+```
+
+## Capabilities
+
+| Capability | HTTP Verb | Description |
+|------------|-----------|-------------|
+| `create` | POST/PUT | Create new data |
+| `read` | GET | Read data |
+| `update` | POST/PUT | Update existing data |
+| `delete` | DELETE | Delete data |
+| `list` | LIST | List keys |
+| `sudo` | - | Root-protected paths |
+| `deny` | - | Explicitly deny access |
+
+## Common Policies
+
+### Application Read-Only
+```hcl
+# app-readonly.hcl
+path "secret/data/myapp/*" {
+  capabilities = ["read", "list"]
+}
+
+path "secret/metadata/myapp/*" {
+  capabilities = ["read", "list"]
+}
+```
+
+### Developer Policy
+```hcl
+# developer.hcl
+path "secret/data/dev/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+path "secret/data/staging/*" {
+  capabilities = ["read", "list"]
+}
+
+# Deny production access
+path "secret/data/prod/*" {
+  capabilities = ["deny"]
+}
+```
+
+### CI/CD Pipeline
+```hcl
+# cicd.hcl
+# Read deployment secrets
+path "secret/data/deploy/*" {
+  capabilities = ["read"]
+}
+
+# Generate dynamic database credentials
+path "database/creds/myapp-role" {
+  capabilities = ["read"]
+}
+
+# Sign SSH keys
+path "ssh-client-signer/sign/deploy-role" {
+  capabilities = ["create", "update"]
+}
+```
+
+### Admin Policy
+```hcl
+# admin.hcl
+# Manage secrets engines
+path "sys/mounts/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+# Manage policies
+path "sys/policies/acl/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+# Manage auth methods
+path "sys/auth/*" {
+  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
+}
+
+# View audit logs
+path "sys/audit" {
+  capabilities = ["read", "list"]
+}
+```
+
+## Policy Templates
+
+### Using Templating
+```hcl
+# Per-user secrets path
+path "secret/data/users/{{identity.entity.name}}/*" {
+  capabilities = ["create", "read", "update", "delete", "list"]
+}
+
+# Team-based access
+path "secret/data/teams/{{identity.groups.names}}/*" {
+  capabilities = ["read", "list"]
+}
+```
+
+## Policy Management
+
+```bash
+# Write policy
+vault policy write myapp-policy myapp-policy.hcl
+
+# List policies
+vault policy list
+
+# Read policy
+vault policy read myapp-policy
+
+# Delete policy
+vault policy delete myapp-policy
+
+# Test policy (requires root)
+vault token create -policy=myapp-policy
+```