Our organization is currently undertaking a formal evaluation for a secrets management solution to replace a fragmented system of encrypted config files and a legacy credential vault. The primary use case is securing database credentials, API keys, and service account certificates for our patient data analytics pipelines, which must adhere to HIPAA and HITRUST requirements. The shortlist has come down to HashiCorp Vault and CyberArk Conjur (their developer-centric offering), and I'm seeking detailed, operational comparisons from this community that go beyond vendor datasheets.
My core evaluation criteria, in order of priority, are:
* **Audit Trail Completeness:** Immutable, granular logging of every authentication, secret access, lease creation/renewal, and policy change. The ability to seamlessly stream these logs to our SIEM (Splunk) is non-negotiable.
* **Dynamic Secrets Lifecycle:** Robust support for short-lived, auto-rotated credentials for PostgreSQL and Snowflake. We need precise control over lease TTLs, renewal windows, and revocation guarantees.
* **Pipeline Integration Burden:** Ease of integration with our existing stack: Apache Airflow for orchestration, Kubernetes (EKS) for runtime, and Terraform for provisioning. The client libraries and authentication methods must be manageable without excessive custom glue code.
* **Operational Resilience:** Performance under load during batch pipeline starts, and the operational overhead of backup, seal/unseal, and cluster management.
From my preliminary benchmarking, I've observed the following architectural divergences:
**HashiCorp Vault** (Open Source/Enterprise)
```
# Example dynamic database role configuration for PostgreSQL
path "database/creds/analytics-role" {
capabilities = ["read"]
allowed_parameters = {
"ttl" = ["1h", "2h"]
}
}
```
* **Pro:** The dynamic secrets engine is native, mature, and offers fine-grained control via Leases. The audit device system provides structured logs (JSON) that are trivial to forward.
* **Con:** The operational model (auto-unseal, performance replication, storage backend) requires dedicated infrastructure knowledge. Integration, while broad, often requires more explicit pipeline code for token renewal.
**CyberArk Conjur** (Open Source/Enterprise)
* **Pro:** Often praised for its centralized policy management and its "host identity" model, which can reduce secret sprawl. The Kubernetes Authenticator Client (KAC) integrates tightly with EKS pod identities.
* **Con:** Dynamic secrets capabilities for databases feel less native than Vault's engines, sometimes relying more on external scripts or integrations. The audit stream is comprehensive but its structure differs.
I am particularly interested in longitudinal experiences: have you managed the *lifecycle* of these platforms over 2+ years in a regulated context? How does the total cost of ownership (including personnel to manage the platform) compare when scaling to hundreds of services and data stores?
-- elliot
Data first, decisions later.