728x90
Vault (HashiCorp Vault) :: 시크릿 관리
Vault: 비밀번호, API 키, 암호화 키 같은 민감한 정보(시크릿)를 안전하게 저장하고 관리해주는 도구
필요성: 비밀번호가 파일이나 명령어에 직접 적혀있지 않고 Vault라는 별도 저장소에서 필요할 때만 꺼내 쓰는 구조
기본 동작 원리
Vault 서버에 시크릿을 저장(암호화된 상태로 보관)
스크립트나 애플리케이션이 Vault에 인증한 뒤, 필요한 시크릿만 API로 요청해서 가져옴
접근 권한, 사용 기록까지 Vault가 관리 가능
실습: Vault로 DB 비밀번호 안전하게 관리하기
Vault 설치
wget https://releases.hashicorp.com/vault/1.17.0/vault_1.17.0_linux_arm64.zip
unzip vault_1.17.0_linux_arm64.zip
sudo mv vault /usr/local/bin/
Vault 실행 파일을 다운로드해서 시스템 명령어로 등록하는 과정
개발 모드로 서버 실행
vault server -dev
>> 별도 설정 없이 바로 테스트해볼 수 있는 개발용 Vault 서버를 실행하는 명령어
새 터미널에서 Vault 주소와 토큰 설정
export VAULT_ADDR=‘http://127.0.0.1:8200’
export VAULT_TOKEN=‘출력된 Root Token 값’
>> vault 명령어가 어느 서버에 어떤 권한으로 접속할지 지정하는 환경변수 설정
Vault 상태 확인
vault status
DB 비밀번호를 시크릿으로 저장
vault kv put secret/db_backup username=root password=실제비밀번호
DB 계정 정보를 secret/db_backup이라는 경로에 암호화해서 저장하는 명령어
저장된 시크릿 확인
vault kv get secret/db_backup
방금 저장한 시크릿을 조회하는 명령어
결과: username과 password 값이 정상적으로 출력됨(권한이 있는 사람만 조회 가능)
스크립트에서 비밀번호를 명령어에 안 적고 가져다 쓰기
vi db_backup_vault.sh
비밀번호를 Vault에서 실시간으로 가져와서 쓰는 백업 스크립트 작성
#!/bin/bash
DB_PASS=$(vault kv get -field=password secret/db_backup)
mysqldump -u root -p(date +%Y%m%d).sql
스크립트 안에 비밀번호가 직접 적혀있지 않고, 실행할 때마다 Vault에서 값을 가져와서 쓰는 구조
실행해서 정상 동작하는지 확인
chmod +x db_backup_vault.sh
./db_backup_vault.sh
>> 비밀번호 노출 없이 백업이 정상적으로 수행되는지 확인하는 명령어
백업 파일이 생성되지만, 스크립트 파일 자체를 열어봐도 실제 비밀번호는 안 보임
접근 기록 확인 (누가 조회했는지)
vault audit enable file file_path=/tmp/vault_audit.log
>> Vault의 감사 로그 기능을 활성화하는 명령어
방금 시크릿을 조회한 기록이 로그에 남아있는지 확인하는 명령어
cat /tmp/vault_audit.log | tail -5
bastion@sieun:~$ cat /tmp/vault_audit.log | tail -5
{"auth":{"accessor":"hmac-sha256:96aac81200c9f038a53c78d366aed92352167d9ee9a64c10fdb7745c1f9ee187","client_token":"hmac-sha256:ecb6b04340277f568dc9ee03ff6332bfb742e46241f71ea2d3741c8f776f8704","display_name":"root","policies":["root"],"policy_results":{"allowed":true,"granting_policies":[{"name":"root","namespace_id":"root","type":"acl"}]},"token_policies":["root"],"token_issue_time":"2026-08-14T16:16:14+09:00","token_type":"service"},"request":{"client_id":"0DHqvq2D77kL2/JTPSZkTMJbkFVmUu0TzMi0jiXcFy8=","client_token":"hmac-sha256:ecb6b04340277f568dc9ee03ff6332bfb742e46241f71ea2d3741c8f776f8704","client_token_accessor":"hmac-sha256:96aac81200c9f038a53c78d366aed92352167d9ee9a64c10fdb7745c1f9ee187","data":{"description":"hmac-sha256:475a5e6c96aa1e42aa5f83e0439075d5b29a3b447d59411d91c859a924eccd82","local":false,"options":{"file_path":"hmac-sha256:cc0fe5046a898ce07a4b9ea8a6f90e03cd6ec438f8276a41f29f7002c5f8ab40"},"type":"hmac-sha256:f9d4050c26e41e6a75d1f8083caa331568ea4ae637d55e1a5d9a5cd8eda611b1"},"id":"993eb87a-75bc-dd6c-91f8-22838e4df126","mount_accessor":"system_e331595b","mount_class":"secret","mount_point":"sys/","mount_running_version":"v1.17.0+builtin.vault","mount_type":"system","namespace":{"id":"root"},"operation":"update","path":"sys/audit/file","remote_address":"127.0.0.1","remote_port":39442},"response":{"mount_accessor":"system_e331595b","mount_class":"secret","mount_point":"sys/","mount_running_plugin_version":"v1.17.0+builtin.vault","mount_type":"system"},"time":"2026-08-14T07:34:59.438814582Z","type":"response"}
{"auth":{"accessor":"hmac-sha256:96aac81200c9f038a53c78d366aed92352167d9ee9a64c10fdb7745c1f9ee187","client_token":"hmac-sha256:ecb6b04340277f568dc9ee03ff6332bfb742e46241f71ea2d3741c8f776f8704","display_name":"root","policies":["root"],"policy_results":{"allowed":true},"token_policies":["root"],"token_issue_time":"2026-08-14T16:16:14+09:00","token_type":"service"},"request":{"client_id":"0DHqvq2D77kL2/JTPSZkTMJbkFVmUu0TzMi0jiXcFy8=","client_token":"hmac-sha256:ecb6b04340277f568dc9ee03ff6332bfb742e46241f71ea2d3741c8f776f8704","client_token_accessor":"hmac-sha256:96aac81200c9f038a53c78d366aed92352167d9ee9a64c10fdb7745c1f9ee187","id":"163b1674-95e8-861c-bb1a-6c15389a76a1","mount_class":"secret","mount_point":"sys/","mount_running_version":"v1.17.0+builtin.vault","mount_type":"system","namespace":{"id":"root"},"operation":"read","path":"sys/internal/ui/mounts/secret/db_backup","remote_address":"127.0.0.1","remote_port":55802},"time":"2026-08-14T07:35:17.210075968Z","type":"request"}
{"auth":{"accessor":"hmac-sha256:96aac81200c9f038a53c78d366aed92352167d9ee9a64c10fdb7745c1f9ee187","client_token":"hmac-sha256:ecb6b04340277f568dc9ee03ff6332bfb742e46241f71ea2d3741c8f776f8704","display_name":"root","policies":["root"],"policy_results":{"allowed":true},"token_policies":["root"],"token_issue_time":"2026-08-14T16:16:14+09:00","token_type":"service"},"request":{"client_id":"0DHqvq2D77kL2/JTPSZkTMJbkFVmUu0TzMi0jiXcFy8=","client_token":"hmac-sha256:ecb6b04340277f568dc9ee03ff6332bfb742e46241f71ea2d3741c8f776f8704","client_token_accessor":"hmac-sha256:96aac81200c9f038a53c78d366aed92352167d9ee9a64c10fdb7745c1f9ee187","id":"163b1674-95e8-861c-bb1a-6c15389a76a1","mount_accessor":"system_e331595b","mount_class":"secret","mount_point":"sys/","mount_running_version":"v1.17.0+builtin.vault","mount_type":"system","namespace":{"id":"root"},"operation":"read","path":"sys/internal/ui/mounts/secret/db_backup","remote_address":"127.0.0.1","remote_port":55802},"response":{"data":{"accessor":"hmac-sha256:9e7429a6ea1b577dcd2b432d91c3d42e97ff4aca0f76c3bdad46e237b7f18ef4","config":{"default_lease_ttl":2764800,"force_no_cache":false,"max_lease_ttl":2764800},"deprecation_status":"hmac-sha256:a0772e172a30d03bcef0a5744f9ba412dcc43176e6c209b2e0e9d7b9260f8d03","description":"hmac-sha256:b232b7e06196026c5cf0bb2db85c9710b7cf2ae2ef95d8dee43048abbc8dd835","external_entropy_access":false,"local":false,"options":{"version":"hmac-sha256:c4d08e2f09ee1281c51c1518192ce70c0957144ef28c9dd19b72c7e00d6d1f2c"},"path":"hmac-sha256:00fa78e60dc4979f0444c29249b7b31a624d0df555485ca5d2fd3fab9fc44f9c","plugin_version":"hmac-sha256:475a5e6c96aa1e42aa5f83e0439075d5b29a3b447d59411d91c859a924eccd82","running_plugin_version":"hmac-sha256:46ca7eaba89601a40a9798314e91144730a3fa7edc17c67674eb151789b70e36","running_sha256":"hmac-sha256:475a5e6c96aa1e42aa5f83e0439075d5b29a3b447d59411d91c859a924eccd82","seal_wrap":false,"type":"hmac-sha256:0fcf558e4c37a5554026b42c2c4ca74632f7f80d7d67cacee293305c6d302210","uuid":"hmac-sha256:ffac9e5dfb8b0749e26ec43cf7c40822885b228bbd9b6ce3d373804dcfbfec53"},"mount_accessor":"system_e331595b","mount_class":"secret","mount_point":"sys/","mount_running_plugin_version":"v1.17.0+builtin.vault","mount_type":"system"},"time":"2026-08-14T07:35:17.210662974Z","type":"response"}
{"auth":{"accessor":"hmac-sha256:96aac81200c9f038a53c78d366aed92352167d9ee9a64c10fdb7745c1f9ee187","client_token":"hmac-sha256:ecb6b04340277f568dc9ee03ff6332bfb742e46241f71ea2d3741c8f776f8704","display_name":"root","policies":["root"],"policy_results":{"allowed":true,"granting_policies":[{"name":"root","namespace_id":"root","type":"acl"}]},"token_policies":["root"],"token_issue_time":"2026-08-14T16:16:14+09:00","token_type":"service"},"request":{"client_id":"0DHqvq2D77kL2/JTPSZkTMJbkFVmUu0TzMi0jiXcFy8=","client_token":"hmac-sha256:ecb6b04340277f568dc9ee03ff6332bfb742e46241f71ea2d3741c8f776f8704","client_token_accessor":"hmac-sha256:96aac81200c9f038a53c78d366aed92352167d9ee9a64c10fdb7745c1f9ee187","id":"bd95ce5f-6cac-f98c-ecf6-54461d2d80b7","mount_class":"secret","mount_point":"secret/","mount_running_version":"v0.19.0+builtin","mount_type":"kv","namespace":{"id":"root"},"operation":"read","path":"secret/data/db_backup","remote_address":"127.0.0.1","remote_port":55802},"time":"2026-08-14T07:35:17.211220563Z","type":"request"}
{"auth":{"accessor":"hmac-sha256:96aac81200c9f038a53c78d366aed92352167d9ee9a64c10fdb7745c1f9ee187","client_token":"hmac-sha256:ecb6b04340277f568dc9ee03ff6332bfb742e46241f71ea2d3741c8f776f8704","display_name":"root","policies":["root"],"policy_results":{"allowed":true,"granting_policies":[{"name":"root","namespace_id":"root","type":"acl"}]},"token_policies":["root"],"token_issue_time":"2026-08-14T16:16:14+09:00","token_type":"service"},"request":{"client_id":"0DHqvq2D77kL2/JTPSZkTMJbkFVmUu0TzMi0jiXcFy8=","client_token":"hmac-sha256:ecb6b04340277f568dc9ee03ff6332bfb742e46241f71ea2d3741c8f776f8704","client_token_accessor":"hmac-sha256:96aac81200c9f038a53c78d366aed92352167d9ee9a64c10fdb7745c1f9ee187","id":"bd95ce5f-6cac-f98c-ecf6-54461d2d80b7","mount_accessor":"kv_5cd9b0ab","mount_class":"secret","mount_point":"secret/","mount_running_version":"v0.19.0+builtin","mount_type":"kv","namespace":{"id":"root"},"operation":"read","path":"secret/data/db_backup","remote_address":"127.0.0.1","remote_port":55802},"response":{"data":{"data":{"password":"hmac-sha256:954a3cae157bd339077557b7236b6924de31291741d337349679b4f7f1d93338","username":"hmac-sha256:2020907c5777adde0975472628e401b45e6e761d815e958ef271137c75532c89"},"metadata":{"created_time":"hmac-sha256:d32872dc39c3d234f2ed164754592b0ff3cac0a504a790ca97aa571a99d9ebe8","custom_metadata":null,"deletion_time":"hmac-sha256:475a5e6c96aa1e42aa5f83e0439075d5b29a3b447d59411d91c859a924eccd82","destroyed":false,"version":2}},"mount_accessor":"kv_5cd9b0ab","mount_class":"secret","mount_point":"secret/","mount_running_plugin_version":"v0.19.0+builtin","mount_type":"kv"},"time":"2026-08-14T07:35:17.211416024Z","type":"response"}
정리 명령어
pkill vault