What are dynamic secrets and why are they safer than static ones?
⚡
Quick Answer
Vault generates credentials on demand with a short TTL and revokes them automatically, minimizing exposure.
Detailed Answer
Instead of one long-lived DB password shared everywhere, Vault's database secrets engine creates a unique username/password per request, valid for minutes/hours, then revokes it. A leaked credential is useless after its lease expires, and every issuance is audited — a huge blast-radius reduction.
💡
Interview Tip
Blast-radius reduction via short TTLs is the key idea.
vaultdynamic-secretsdatabase