LAB 25 ‐ Vault Use in OCI Compute - DevWithNehaCloud/Oracle-Cloud-Infrastructure-wiki GitHub Wiki

OCI Vault – Complete Explanation

What is OCI Vault?

In Oracle Cloud Infrastructure (OCI), Vault is a security service used to securely store and manage:

  • Encryption Keys
  • Secrets
  • Certificates

OCI Vault helps protect sensitive data like:

  • Passwords
  • API Keys
  • Database Credentials
  • Encryption Keys
  • SSH Keys

Instead of storing sensitive information directly inside applications or scripts, we store them securely in Vault.

Why OCI Vault is Important

Without Vault:

  • Passwords may be hardcoded in scripts
  • Secrets can be exposed
  • Data becomes less secure

With Vault:

  • Secrets are encrypted
  • Access is controlled using IAM policies
  • Keys can be rotated for better security
  • Sensitive information stays protected

Real-Life Example

Suppose a company has:

  • A database password
  • API authentication token
  • SSH private key

If these are stored in a normal text file, anyone with access can read them.

Instead, the company stores them inside OCI Vault.

Application Flow

  1. Application requests secret from Vault
  2. Vault verifies permissions
  3. Secret is securely provided
  4. Application uses it safely

This improves security and compliance.

Main Components of OCI Vault

1. Vault

Vault is the main secure container that stores:

  • Keys
  • Secrets
  • Certificates

Think of it like a secure digital locker.

2. Master Encryption Key (MEK)

A Master Encryption Key is used to encrypt and decrypt data.

Types

  • Oracle Managed Key
  • Customer Managed Key

Example

If you store a database password in Vault:

  • Vault encrypts the password using the encryption key
  • Only authorized users/services can decrypt it

3. Secret

Secrets are confidential values stored securely.

Examples

  • Database Password
  • API Token
  • SSH Key
  • OAuth Credentials

Example Secret

DB_PASSWORD = MySecurePass123

Instead of storing this in code:

password = "MySecurePass123"

Applications fetch it securely from Vault.

4. Key Versioning

OCI Vault allows multiple versions of a key.

Benefits

  • Key rotation
  • Improved security
  • Old encrypted data remains accessible

Types of Vault in OCI

1. Virtual Private Vault

  • Dedicated private vault
  • Higher isolation
  • Better security
  • Recommended for enterprise workloads

Use Case

Banks or financial organizations.

2. Default Shared Vault

  • Shared infrastructure
  • Lower cost
  • Suitable for normal workloads

Use Case

Learning, testing, small projects.

OCI Vault Architecture

Application
     ↓
OCI Vault
     ↓
Secrets / Encryption Keys
     ↓
Secure Access via IAM Policies

Practical Example

Scenario

You have a web application connected to a database.

Without Vault

db_password = "Admin@123"

Risk

Password exposed in source code.

With Vault

Application:

Fetch password from OCI Vault

Benefits

  • Secure
  • Centralized management
  • Easy rotation

OCI Vault Features

Feature Explanation
Encryption Protects sensitive data
Key Rotation Creates new key versions
IAM Integration Access control using policies
Secret Management Stores confidential information
Audit Logging Tracks activities
High Availability Reliable access

IAM Policy Example

Allow group Developers to manage secret-family in compartment Security

Meaning

Developers group can manage secrets in Security compartment.

Common Use Cases of OCI Vault

1. Database Password Protection

Store DB passwords securely.

2. API Key Management

Protect API credentials.

3. Boot Volume Encryption

Encrypt OCI storage volumes.

4. Kubernetes Secret Management

Secure container application credentials.

5. DevOps Pipelines

Store CI/CD secrets safely.

Difference Between Vault and Secret

Vault Secret
Secure container Actual confidential value
Stores keys and secrets Stores password/token
Parent service Child object

Difference Between Oracle Managed Key and Customer Managed Key

Oracle Managed Customer Managed
Managed by OCI Managed by customer
Easier setup More control
Less customization Full lifecycle control

Advantages of OCI Vault

  • Strong security
  • Centralized secret management
  • Prevents credential exposure
  • Easy integration with OCI services
  • Supports compliance requirements

Limitations

  • Advanced vaults may increase cost
  • Requires IAM policy configuration
  • Key management needs planning

Best Practices

Do

  • Rotate keys regularly
  • Use least privilege IAM policies
  • Store all secrets in Vault
  • Enable auditing

Avoid

  • Hardcoding passwords
  • Sharing keys manually
  • Using overly broad permissions

Short Summary

OCI Vault is a secure key and secret management service in OCI used to:

  • Protect sensitive information
  • Encrypt data
  • Manage passwords and API keys
  • Improve cloud security

It helps organizations securely manage secrets instead of storing them directly inside applications or scripts.

How OCI Vault Works

Step-by-Step Process

Step 1: Create Vault

Create a Vault from OCI Console.

Click on the Burger Menu in left side, select Identity & Security than go to the Key Management and select vault

Click on Create Vault

select compartment, choose a name and click on create vault

Vault is created (myapp-dev-vault)

Step 2: Create Encryption Key

Generate or import an encryption key.

Open Vault information page and click on Master encryption keys then click on create key

Select compartment, give the name of keys, select protection mode and click on Create key

Now you can see Key is created (myapp-dev-vault-keys)

OCI Vault: Software-Protected Keys vs HSM-Protected Keys

Overview

When creating a key in OCI Vault, OCI provides two protection modes:

  1. Software-Protected Keys
  2. HSM-Protected Keys

These protection modes define where and how the encryption keys are protected and stored.

1. Software-Protected Keys

Software-Protected Keys are protected using software-based security mechanisms.

The key material is stored and protected by software within OCI infrastructure.

Features

  • Lower cost
  • Faster provisioning
  • Suitable for most workloads
  • Easier to use
  • Good for development and general production environments

Common Use Cases

  • Object Storage encryption
  • Block Volume encryption
  • Boot Volume encryption
  • General application encryption
  • Test/Dev environments

Example

A company wants to encrypt:

  • OCI Buckets
  • Boot Volumes
  • Block Volumes

without strict compliance requirements.

✅ Use Software-Protected Key

Advantages

  • Cost-effective
  • Easy deployment
  • Good performance
  • Suitable for standard security requirements

Limitation

Security level is lower compared to dedicated hardware security modules (HSMs).

2. HSM-Protected Keys

HSM stands for:

Hardware Security Module

HSM-Protected Keys are stored inside dedicated tamper-resistant hardware devices.

The key material never leaves the HSM hardware.

Features

  • Highest security level
  • Hardware-based protection
  • FIPS 140-2 Level 3 certified
  • Designed for highly sensitive workloads
  • Used for strict compliance and regulatory requirements

Common Use Cases

  • Banking systems
  • Financial applications
  • Government workloads
  • Healthcare systems
  • PCI-DSS compliance
  • Highly sensitive enterprise applications

Example

A banking application stores highly sensitive customer financial data and must meet compliance standards.

✅ Use HSM-Protected Key

Advantages

  • Very high security
  • Hardware isolation
  • Strong compliance support
  • Tamper-resistant protection

Limitation

  • Higher cost
  • Slightly more complex management

Main Difference

Feature Software-Protected Key HSM-Protected Key
Protection Type Software-based Hardware-based
Security Level Standard Very High
Cost Lower Higher
Compliance Support Basic Advanced
Performance Faster provisioning Slightly slower
Best For General workloads Sensitive workloads
Key Storage OCI software layer Dedicated HSM hardware

Real-World Analogy

Software-Protected Key

Like storing valuables in a secure application locker protected by software security.

HSM-Protected Key

Like storing valuables inside a highly secure physical bank vault with hardware protection and tamper detection.

OCI Recommendation

Use Software-Protected Keys When:

  • Standard encryption is enough
  • Cost optimization is important
  • General workloads
  • Learning and testing environments
  • Normal enterprise applications

Use HSM-Protected Keys When:

  • Compliance is required
  • Financial or healthcare data is involved
  • Maximum security is needed
  • Enterprise security policies require HSM

Interview Explanation

Software-Protected Keys are protected using OCI software-based security mechanisms, while HSM-Protected Keys are stored inside dedicated Hardware Security Modules for higher security and compliance requirements.

Short Summary

Key Type Best Use
Software-Protected Key General encryption workloads
HSM-Protected Key Highly sensitive and regulated workloads

OCI Vault – Key Shape Algorithms (AES vs RSA vs ECDSA)

Overview

When creating a key in Vault, we choose:

  • Protection Mode
    • Software
    • HSM

and also choose the Key Shape Algorithm.

The key shape algorithm defines:

  • how the key works,
  • whether it is symmetric or asymmetric,
  • and what operations it supports.

1. AES (Symmetric Key)

Definition

AES (Advanced Encryption Standard) is a symmetric key algorithm.

It uses:

  • the same key for encryption
  • and the same key for decryption.

OCI Description

AES (Symmetric Key) – Used for Encrypt and Decrypt

How It Works

Plain Data
   ↓
Encrypt using AES Key
   ↓
Encrypted Ciphertext
   ↓
Decrypt using SAME AES Key
   ↓
Original Data

Main Purpose in OCI

AES keys are mainly used for:

  • Encrypting block volumes
  • Encrypting object storage
  • Encrypting boot volumes
  • Encrypting databases
  • Encrypting secrets/data at rest

OCI Real-Time Example

Example 1 – Encrypt Boot Volume

When you enable:

Encrypt Boot Volume using Customer Managed Key

OCI uses an AES symmetric key to:

  • encrypt the boot volume
  • and decrypt it when the instance starts.

Example 2 – Encrypt Object Storage

If sensitive files are stored in Object Storage:

Documents → Encrypted using AES key

OCI automatically decrypts the files when authorized users access them.

When to Use AES in OCI

Use AES when:

  • You need fast encryption/decryption
  • You want to protect stored data
  • You are encrypting large amounts of data
  • You need encryption at rest

Advantages

  • Very fast
  • Best for storage encryption
  • Efficient for large data
  • Most commonly used in OCI Vault

Limitation

Same key is used for:

  • encryption
  • decryption

So the key must be protected carefully.

2. RSA (Asymmetric Key)

Definition

RSA is an asymmetric key algorithm.

It uses:

  • one Public Key
  • one Private Key

OCI Description

RSA (Asymmetric Key) – Used for Encrypt, Decrypt, Sign, and Verify

How It Works

Encryption Flow

Public Key → Encrypt Data
Private Key → Decrypt Data

Digital Signature Flow

Private Key → Sign
Public Key → Verify

Main Purpose in OCI

RSA keys are commonly used for:

  • Secure communication
  • API authentication
  • Digital signatures
  • SSL/TLS certificates
  • Encrypting small sensitive data
  • Identity verification

OCI Real-Time Example

Example 1 – API Request Signing

When OCI CLI or SDK sends API requests:

Private RSA Key → Signs request
OCI → Verifies using Public Key

This confirms:

  • the request is authentic
  • and not modified.

Example 2 – Secure Data Sharing

Suppose:

  • Application A wants to send secure data to Application B.

Flow:

Application B shares Public Key
Application A encrypts data using Public Key
Application B decrypts using Private Key

When to Use RSA in OCI

Use RSA when:

  • Secure key exchange is needed
  • Digital signatures are required
  • Authentication is needed
  • Public/private key architecture is required

Advantages

  • Very secure
  • Supports encryption + signatures
  • Ideal for authentication

Limitation

  • Slower than AES
  • Not efficient for encrypting very large data

3. ECDSA (Elliptic Curve Digital Signature Algorithm)

Definition

ECDSA is an asymmetric algorithm mainly used for:

  • Digital Signatures
  • Signature Verification

It does NOT perform encryption/decryption like RSA.

OCI Description

ECDSA (Asymmetric Key) – Used for Sign and Verify

How It Works

Private ECDSA Key → Sign Data
Public ECDSA Key → Verify Signature

Main Purpose in OCI

ECDSA is mainly used for:

  • Digital signatures
  • Certificate signing
  • Identity verification
  • High-security lightweight cryptography

OCI Real-Time Example

Example 1 – Certificate Signing

A service signs certificates using:

ECDSA Private Key

Other systems verify using:

ECDSA Public Key

Example 2 – Secure Authentication

Modern lightweight secure systems may use ECDSA because:

  • it provides strong security
  • with smaller key size.

When to Use ECDSA in OCI

Use ECDSA when:

  • Only signing and verification are needed
  • High performance with strong security is required
  • Lightweight cryptography is preferred

Advantages

  • Smaller key size
  • Faster than RSA for signatures
  • Strong security
  • Efficient performance

Limitation

  • Cannot encrypt/decrypt data directly
  • Mainly used only for digital signatures

Difference Between AES vs RSA vs ECDSA

Feature AES RSA ECDSA
Key Type Symmetric Asymmetric Asymmetric
Keys Used Same key Public + Private Public + Private
Encrypt Yes Yes No
Decrypt Yes Yes No
Sign No Yes Yes
Verify No Yes Yes
Speed Very Fast Slower Faster than RSA
Best For Data Encryption Secure Communication Digital Signatures
OCI Common Usage Volume/Object Encryption API Signing/Auth Certificate Signing

Simple OCI Usage Summary

OCI Scenario Recommended Key
Encrypt Boot Volume AES
Encrypt Block Volume AES
Encrypt Object Storage AES
Encrypt Database AES
OCI API Request Signing RSA
SSL/TLS Authentication RSA
Digital Signature RSA / ECDSA
Lightweight Secure Signing ECDSA

Final Quick Summary

AES

Symmetric key
Used for Encrypt + Decrypt
Best for storage/data encryption
Most commonly used in OCI Vault

RSA

Asymmetric key
Used for Encrypt + Decrypt + Sign + Verify
Best for authentication and secure communication

ECDSA

Asymmetric key
Used only for Sign + Verify
Best for lightweight high-security digital signatures