Repository navigation
Lab: 23 Vault use in OCI Compute
OCI Vault is a secure OCI service used to centrally manage encryption keys and secrets for protecting cloud resources and sensitive data.
Most Important Points About OCI Vault
1. Security (Main Purpose)
OCI Vault helps protect important data from unauthorized access.
Example:
Database encryption keys Application passwords SSL certificates
Without Vault, storing these directly in code or servers is risky.
2. Key Management
Vault is mainly used for Key Management.
What is a Key?
An encryption key is a secret code used to:
Encrypt data → convert into unreadable form Decrypt data → convert back into readable form
OCI services use these keys to secure:
Block volumes Databases Object storage Kubernetes secrets
3. Centralized Control
Vault gives one central place to:
Create keys Rotate keys Disable/Delete keys Track usage
This makes security management easier.
4. Types of Keys in OCI Vault Oracle-managed keys
OCI manages everything automatically.
Customer-managed keys
You create and control the keys yourself.
This is important for:
Compliance Enterprise security Full ownership of encryption
5. Automatic Key Rotation
Vault can automatically change encryption keys periodically.
Why important?
Reduces hacking risk Improves security standards
6. Hardware Security Module (HSM)
OCI Vault can store keys inside special secure hardware called HSM.
HSM means:
A tamper-resistant device designed specifically for protecting cryptographic keys.
This gives very high security.
Lifecycle of Key
Protection mode:
HSM MODE = Hardware Security Module (Physical device protects keys)
SOFTWARE MODE = Software-based protection (Server software protects keys)
Note:Both encrypt your data, but different security levels.
KEY SHAPE = Blueprint of encryption key
