Enterprise-Grade Secret Management for Database Operations

In today's data-driven landscape, protecting sensitive information is paramount. Database credentials, API keys, and encryption keys are the crown jewels of enterprise security—and their management can make or break your security posture. IBM Db2 Genius Hub now offers seamless integration with HashiCorp Vault, bringing enterprise-grade secret management and encryption key separation to your autonomous database operations.

The Challenge: Managing Secrets and Keys at Scale

Traditional approaches to managing database secrets often fall short:

• Hardcoded credentials in configuration files create security vulnerabilities
• Encryption keys stored with encrypted data violate security best practices
• Manual key rotation is error-prone and requires downtime
• Lack of audit trails makes compliance difficult
• No separation of duties between data and key management

Consider a typical enterprise deployment:

The Solution: HashiCorp Vault Integration

What HashiCorp Vault Provides

When you integrate Vault with Genius Hub, you get one critical thing: external encryption key storage.

What this means:

• Genius Hub stores your encrypted database credentials
• Vault stores the encryption key needed to decrypt them
• These two pieces are physically separated

In practice:

• DBAs manage credentials in Genius Hub (but can't access the encryption key)
• Security team manages the encryption key in Vault (but can't access the encrypted credentials)
• No single person or system has both pieces

This is separation of duties and defense in depth - core security principles that Vault enables for Genius Hub.

Important clarification: Your database credentials (usernames/passwords) are NOT stored in Vault. They remain in Genius Hub's database, encrypted. Only the encryption key lives in Vault.

How It Works

Without Vault Integration (Default)

User enters password → Genius Hub encrypts with internal key → Stores in database
User needs password → Genius Hub decrypts with internal key → Returns to user

With Vault Integration

User enters password → Genius Hub requests key from Vault → Encrypts password → Stores in database
User needs password → Genius Hub requests key from Vault → Decrypts password → Returns to user

Critical difference: Genius Hub never stores the encryption key. It requests the key from Vault on-demand, uses it for encryption/decryption, then discards it from memory.

Encryption Scope

When you enable "Use password encryption key store" for a connection profile, all credential types are encrypted with the Vault key:

Implementation Guide

Prerequisites

• IBM Db2 Genius Hub Version 1.1.2.0 or later
• HashiCorp Vault server (self-hosted or HCP Vault)
• Network connectivity between Genius Hub and Vault
• Console Administrator access in Genius Hub

Step 1: Configure HashiCorp Vault

Set up AppRole authentication and create a policy for Genius Hub:

# Enable AppRole authentication
vault auth enable approle

# Create a policy for Genius Hub
# Note: <<EOF is heredoc syntax - it allows multi-line input until the closing EOF
vault policy write genius-hub-policy - <<EOF
path "secret/data/genius-hub/*" {
  capabilities = ["read", "list"]
}
EOF

# Create an AppRole
vault write auth/approle/role/genius-hub \
    token_policies="genius-hub-policy" \
    token_ttl=1h \
    token_max_ttl=4h

# Get Role ID (save this)
vault read auth/approle/role/genius-hub/role-id

# Generate Secret ID (save this)
vault write -f auth/approle/role/genius-hub/secret-id

Important: Securely store both the Role ID and Secret ID-they are required for Genius Hub configuration.

Step 2: Store Encryption Key in Vault

Create the encryption key in Vault. The key name must be Encryption_Key (case-sensitive):

# Generate a strong 256-bit encryption key
openssl rand -hex 32

# Store in Vault
vault kv put secret/genius-hub/db-credentials \
    Encryption_Key="your-256-bit-encryption-key"

You can also store additional secrets like database credentials:

# Store database credentials
vault kv put secret/genius-hub/db-credentials \
    username="db2admin" \
    password="SecurePassword123!" \
    Encryption_Key="your-256-bit-encryption-key"

# Store API keys
vault kv put secret/genius-hub/api-keys \
    monitoring-api-key="your-api-key-here"

Step 3: Configure IBM Db2 Genius Hub

Only Console Administrators can create secret profiles:

1. Navigate to Administration > Console > Secrets Manager

2. Click Create New Secret

3. Fill in the required fields:

(i) Secret name: Descriptive name (e.g., Production Vault)

(ii) Secret description: Optional documentation

(iii) Secret Provider: Select HashiCorp Vault

(iv) Secret path: Full Vault URL with API path (e.g., https://vault.example.com:8200/v1/secret/data/genius-hub/db-credentials)

(v) Secret ID: AppRole Secret ID from Step 1

(vi) Role ID: AppRole Role ID from Step 1

4. Click Create to save

Step 4: Use the secret for database connections

When creating or editing a database connection:

1. Navigate to Connections > Add database connection (or edit existing)
   
2. Fill in connection details (hostname, port, database name)
3. Enable Use password encryption key store
   
4. Select your secret profile from the dropdown (e.g., Production Vault)
   
5. Enter credentials for monitoring, job, and personal access
   
6. Click Save
   

All credentials for this connection are now encrypted using the key stored in HashiCorp Vault.

Video

To see this in action, here is a walkthrough showing the process of configuring HashiCorp Vault, creating secret profiles in Genius Hub, and applying encryption key storage to database connections.

Security Benefits

1. Separation of Duties

No single person has access to both encrypted data and encryption keys.

2. Simplified Key Rotation

Traditional Approach:

• Generate new key → Decrypt all credentials with old key → Re-encrypt with new key → Update database → Coordinate downtime → Test connections

With Vault Integration:

1. Update key in Vault: vault kv put secret/genius-hub/db-credentials Encryption_Key="new-key"
2. One has to come to GH connection page and save again to reflect the new encryption key usage. Otherwise database authentication will fail.
3. Genius Hub automatically uses the new key for all subsequent operations

3. Comprehensive Audit Trail

Vault provides detailed audit logging for compliance:

{
  "time": "2026-05-01T14:30:00Z",
  "type": "response",
  "auth": {
    "display_name": "approle",
    "policies": ["genius-hub-policy"],
    "metadata": {"role_name": "genius-hub"}
  },
  "request": {
    "operation": "read",
    "path": "secret/data/genius-hub/db-credentials"
  }
}

4. Disaster Recovery

Encryption keys are backed up with your Vault infrastructure—separate from Genius Hub backups:

1. Restore Genius Hub from backup → Contains encrypted credentials (no keys)
2. Genius Hub connects to Vault → Retrieves encryption keys
3. All connections work immediately → No manual key recovery or credential re-entry

If Genius Hub is compromised, encrypted credentials are useless without Vault access. In addition, the encryption key in Vault can be rotated immediately to invalidate any potentially exposed encrypted data.

5. Compliance Support