Every app instance gets its own credential — and it expires on its own.
Vault's dynamic secrets create a brand-new database user per request, on a lease, and auto-revoke it on expiry — Vault's single most impressive feature.
Static secret model
One password, forever
Shared by every instance, valid until someone manually notices a leak and rotates. No per-instance traceability.
Dynamic secret model
Unique, self-expiring
Every instance gets its own credential, auto-revoked on lease expiry — a leak self-bounds its own exposure window.
Envelope encryption — how a KMS scales to any data size
1
Your data→
2
DEK encrypts itfast, local, one-time-use
→
3
KMS encrypts the DEKthe KEK never leaves the KMS
A leaked dynamic credential self-expires — you're no longer racing to notice and manually rotate it.