With over 15 supported storage backends it can be a bit of an arduous task to determine which storage backend should be used for a HashiCorp Vault deployment. The goal of this blog post is to help simplify that process with a simple visual decision tree that accounts for some of the common decision points when determining which storage backend to utilize for a deployment.
Development Storage Backend
The filesystem and In-memory storage backends are both great options for quickly getting started with HashiCorp Vault. The other storage backends require an external server(s) or service in order to start using them.
Preferred Production Storage Backend
The preferred storage backend is Hashicorp’s Consul product which is the only backend that checks both the high availability and Hashicorp supported boxes. The reference architecture (https://www.vaultproject.io/guides/operations/reference-architecture.html) created by HashiCorp details how Vault can be implemented in a highly available manner using HashiCorp consul.
Cloud Agnostic Highly Available Backend Options
The following storage backends are viable options for cloud agnostic solutions that allow any underlying IaaS platform to be used given that the backend isn’t tied to a particular cloud provider’s managed service.
- HashiCorp Consul
Cloud Specific Backend Options
There a number of public cloud managed services that can be leveraged as a storage backend. The benefit of these options are that they are managed services provided by public cloud providers and become extremely compelling if there are existing workloads in one of those public clouds.
- AWS S3
- AWS DynamoDB
- Azure Storage Container
- Triton Manta Object Storage
- GCP Cloud Storage
- GCP Cloud Spanner
Hashicorp Storage Backend
HashiCorp Reference Architecture