Skip to main content

​
Vault

Vault is a secrets management service for API keys, credentials, and environment variables. All secrets are encrypted at rest with AES-256-GCM and backed by AWS KMS or a local master key.

​
Features

Encrypted Storage

AES-256-GCM encryption at rest

Version History

Full audit trail with rollback

Environment Separation

Prod/Staging/Dev isolation

Access Control

Role-based permissions

​
Quick Start

# Store a secret
BrainzLab::Vault.set("stripe/api_key", "sk_live_xxx")

# Retrieve a secret
api_key = BrainzLab::Vault.get("stripe/api_key")

# Store with environment
BrainzLab::Vault.set("database/password", "secret123", environment: :production)

​
Security Model

┌─────────────────────────────────────────────────────┐
│                     Your App                         │
│                        │                             │
│                        ▼                             │
│              BrainzLab::Vault.get()                 │
│                        │                             │
│                        ▼                             │
│  ┌─────────────────────────────────────────────┐    │
│  │               Vault API                      │    │
│  │                    │                         │    │
│  │                    ▼                         │    │
│  │  ┌─────────────────────────────────────┐    │    │
│  │  │  Encrypted Storage (PostgreSQL)     │    │    │
│  │  │  + AES-256-GCM encryption           │    │    │
│  │  │  + AWS KMS for key management       │    │    │
│  │  └─────────────────────────────────────┘    │    │
│  └─────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────┘

​
Key Features

FeatureDescription
EncryptionAES-256-GCM at rest
Key ManagementAWS KMS or local master key
VersioningFull history for every secret
RollbackRestore to any previous version
Audit LogWho accessed what, when
RBACRole-based access control
EnvironmentsSeparate secrets per environment

​
Environment Separation

Secrets are isolated by environment:
EnvironmentAccess
ProductionRequires approval, locked by default
StagingTeam access
DevelopmentOpen access
# Production secret (requires special access)
BrainzLab::Vault.get("database/password", environment: :production)

# Development secret
BrainzLab::Vault.get("database/password", environment: :development)

​
Next Steps

Secrets

Store and retrieve secrets

Environments

Manage environment-specific secrets

Access Control

Configure permissions

Audit Log

View access history