Oracle Cloud Infrastructure Vault is a managed service that lets you centrally manage the encryption keys that protect your data and the secret credentials that you use to securely access resources. Vaults securely store master encryption keys and secrets that you might otherwise store in configuration files or in code. Specifically, depending on the protection mode, keys are either stored on the server or they are stored on highly available and durable hardware security modules (HSM) that meet Federal Information Processing Standards (FIPS) 140-2 Security Level 3 security certification.

The key encryption algorithms that the Vault service supports includes the Advanced Encryption Standard (AES), the Rivest-Shamir-Adleman (RSA) algorithm, and the elliptic curve digital signature algorithm (ECDSA). You can create and use AES symmetric keys and RSA asymmetric keys for encryption and decryption. You can also use RSA or ECDSA asymmetric keys for signing digital messages.

You can use the Vault service to create and manage the following resources:

• Vaults
• Keys
• Secrets

You can use the Vault service to exercise the following lifecycle management features for vaults, master encryption keys, and secrets, helping you to control these resources and access to them:

• Create vaults
• Create or import cryptographic material as master encryption keys
• Create secrets to store secret credentials
• Enable or disable master encryption keys for use in cryptographic operations
• Rotate keys to generate new cryptographic material
• Export key or vault metadata to a backup that you can restore and use again later
• Continuously replicate a vault and its keys to another region in the realm
• Update secrets with new secret contents
• Specify which secret version is currently in use through promotion
• Configure rules to govern the management and use of secrets
• Tag vaults, master encryption keys, or secrets to add metadata to resources
• Delete vaults, keys, or secrets when they’re no longer needed

Regarding the use of master encryption keys, you can do the following:

• Use keys for encryption and decryption of data while at rest or in transit
• Use keys to sign messages and verify signed messages
• Assign keys to supported Oracle Cloud Infrastructure resources, including, but not limited to, buckets and file systems
• Generate data encryption keys

The following services integrate with the Vault service to support the use of customer-managed keys to encrypt data in their respective, specified resources:

• Oracle Cloud Infrastructure Block Volume: block and boot volumes
• Oracle Cloud Infrastructure Container Engine for Kubernetes: Kubernetes secrets at rest in the etcd key-value store (when creating new clusters only)

• Oracle Cloud Infrastructure Database: Autonomous Container Databases on dedicated Autonomous Exadata Infrastructure and Exadata Databases. Note that Exadata Cloud Service databases using Oracle Data Guard must have both the primary and the standby in the same region when using customer-managed keys.

• Oracle Cloud Infrastructure File Storage: file systems
• Oracle Cloud Infrastructure Object Storage: buckets
• Oracle Cloud Infrastructure Streaming: stream pools

In addition, integration with Oracle Cloud Infrastructure Identity and Access Management (IAM) lets you control who and what services can access which keys and secrets and what they can do with those resources. Oracle Cloud Infrastructure Audit integration gives you a way to monitor key and secret usage. Audit tracks administrative actions on vaults, keys, and secrets.