Vault Associate case studies
Vault Associate · Put your knowledge to work in context.
Vault Associate is HashiCorp's entry-level certification for practitioners who work with Vault, the secrets management product. It is aimed at people who already touch Vault in some capacity - platform engineers, cloud and security engineers, DevOps staff, and administrators - and who need to prove they can operate it day to day rather than just describe it. The Vault Associate case studies are 5 cases and about 4,108 words.
1CI runners on a shared AppRole secret_id, 30-day deadline
A platform team runs Vault 1.15 on integrated storage for 400 engineers. Their CI system authenticates with AppRole at auth/approle : a single role ci-deploy with bind secret id=true , secret id ttl=0 , token ttl=1h , token max ttl=1h .
799 words, about 4 min2KV v2 policy written against the wrong paths
An application team stores configuration on a KV v2 mount at kv/ (they use vault kv get kv/myapp/db ). Their policy contains exactly one stanza: vault kv get works, but vault kv list kv/myapp returns 403 and vault kv destroy returns 403 - which security is quietly pleased about, since the app must never be able to permanently remove a version.
761 words, about 4 min3A six-hour batch job on a one-hour token
A data-platform team runs a Python worker that drains a nightly backlog. Median run is 35 minutes, but month-end runs reach 6 hours 20 minutes.
784 words, about 4 min4Dynamic database credentials for a tool that only reads its config at start-up
A BI team's reporting service connects to PostgreSQL through the database secrets engine mounted at database/ . It currently uses one static account bi reader whose password sits in a config file.
883 words, about 4 min5Audit disk full at 03:00 on a three-node auto-unseal cluster
A three-node Vault 1.15 cluster uses integrated storage with auto-unseal backed by a cloud KMS. There is exactly one audit device: a file device whose path sits on the same volume as the Raft data.
881 words, about 4 min