What is HCP Vault Dedicated?
HCP Vault Dedicated is a hosted version of Vault Enterprise operated by HashiCorp to allow organizations to get up and running quickly. HCP Vault Dedicated uses the same binary as self-hosted Vault Enterprise, which means you will have a consistent user experience. You can use the same CLI, API, and UI to communicate with HCP Vault Dedicated as you use to communicate with a self-hosted Vault Enterprise.
HCP Vault Dedicated clusters can be created on either AWS or Azure across multiple regions across North America, Asia, and Europe. We will support additional cloud providers in the future.
Why HCP Vault Dedicated?
Vault Enterprise running on the HashiCorp Cloud Platform (HCP) enables users to secure, store, and tightly control access to tokens, passwords, certificates, and encryption keys within one unified cloud-based platform.
The benefits of HCP Vault Dedicated are:
Reduce operational overhead: Push-button deployment, fully managed upgrades, and backups mean organizations can focus on adoption and integration instead of operational overhead.
Increase security across clouds and machines: Secure your infrastructure across all your environments through a single interface and globally control and restrict access to sensitive data and systems.
Control cost: Reduce the number of systems, licenses, and manual overhead by centralizing secrets management with HCP Vault Dedicated.
Day zero readiness: Modern cloud security to quickly secure applications, access, and data from day zero.
Reliability: HashiCorp has experience supporting thousands of commercial Vault Enterprise clusters and HCP Vault Dedicated brings that expertise directly to users.
Ease of use: HCP Vault Dedicated is built around making cloud security automation simple. Get up and running quickly so that you can onboard applications and teams easily.
Feature parity
Since HCP Vault Dedicated uses the same binary as Vault Enterprise, most enterprise features are available to HCP Vault Dedicated users. Some features such as auto-unseal are managed by HashiCorp to manage the cluster.
The table below compares the features available on the self-managed Vault Enterprise and HCP Vault Dedicated.
| Features | Self-managed | HCP Vault Dedicated |
|---|---|---|
| All community edition features | ✅ | ✅ |
| Namespaces | ✅ | ✅ |
| Performance replication | ✅ | ✅ |
| Paths filter | ✅ | ✅ |
| Read replica | ✅ | ✅ |
| Disaster Recovery (DR) replication | ✅ | ✅ |
| Control groups | ✅ | ✅ |
| Sentinel | ✅ | ✅ |
| HSM auto-unseal | ✅ | ❌ |
| Entropy augmentation | ✅ | ❌ |
| FIPS 140-2 & seal wrap | ✅ | ❌ |
| KMIP secrets engine | ✅ | ✅ |
| Key management secrets engine | ✅ | ✅ |
| Transform secrets engine | ✅ | ✅ |
| Automatic minor version upgrade | ❌ | ✅ |
| Automatic major version upgrade | ❌ | ✅ |
| Audit logging by default | ❌ | ✅ |
| Snapshots & restore | ❌ | ✅ |
Note
For the self-managed Vault Enterprise clusters, audit logging is a manual configuration. Similarly, if your self-managed Vault Enterprise is running with Integrated Storage, you can configure an automatic data snapshot. However, HCP Vault Dedicated automates the audit logging process.
Resources:
Self-managed vs. HCP Vault Dedicated cluster
Here is a quick comparison between a self-managed Vault Enterprise cluster and an HCP Vault Dedicated cluster.
| Cluster Feature | Self-managed | HCP Vault Dedicated |
|---|---|---|
| Vault Edition | Vault Community Edition or Vault Enterprise | Vault Enterprise |
| Storage backend | Choose one and self-manage | Integrated Storage |
| Seal | Seal uses Shamir's Secret Sharing algorithm to generate key shares by default. | Auto-unseal is configured. A unique Key Management Service (KMS) key is created for each cluster. |
| Vault version | Self-manage the upgrade process | Minor and major versions are upgraded for you automatically. See the Vault Version documentation for more detail. |
| Top-level Namespace | root | admin |
| Root/admin token | Vault initialization process generates a root token. To regenerate a root token, unseal keys or recovery keys are required. | Click on the Generate token button via HCP Vault Dedicated Portal returns an admin token which is valid for 6 hours. |
| Advanced Data Protection (ADP) features | Available with Vault Enterprise license | Available with HCP Vault Dedicated Plus. |
| Enterprise Replication | Available with Vault Enterprise license | Performance Replication is available with HCP Vault Dedicated Plus. |
| Cluster Scaling | No built in feature to scale the cluster size up or down. | Scale your cluster size dynamically via the HashiCorp Cloud Platform Portal or Terraform. |
| Tier Sizing | Not applicable | For information on tier sizing and pricing, see HCP Vault Dedicated Pricing. |
| Sentinel and Control Groups | Available with Vault Enterprise license | Available with HCP Vault Dedicated Plus. |
HCP Vault Dedicated on Azure
HCP Vault Dedicated on Azure includes all features found on AWS with the exception of following features which are planned:
- Snapshots retained for 30 days after cluster deletion to support cluster restore
- Oracle Database Secrets Plugin
- KMIP Secrets Engine
Tutorial
Refer to the Getting Started with HCP Vault Dedicated tutorial to get hands-on with HCP Vault Dedicated and set up your managed Vault cluster.
Looking for Vault fundamentals?
Read core Vault documentation and tutorials, including self-hosted open source docs.
