KV Secrets Engine vs Transit Secrets Engine: Storage vs Encryption as a Service in Vault

One of the first choices when adopting Vault is whether to store secrets in Vault or use Vault only as an encryption service. Both are Vault secrets engines, but the data location and responsibility boundaries are completely different. This post compares KV-based storage with Transit-based encryption services and categorizes the open-source options.

KV Secrets Engine: Store Secrets Inside Vault

KV is literally a key-value store. Secrets an application needs, such as DB passwords and API tokens, are stored inside Vault and read when needed. They benefit from Vault's access control and audit logging, and Vault becomes the single source of truth.

Key Characteristics

• Data location: Vault storage backend
• Access pattern: Primarily reads/writes
• With KV v2 support, versioning and metadata are available
• Vault downtime also prevents secret retrieval, making availability design important

Example: Basic KV v2 Operations

# 환경 변수
export VAULT_ADDR="http://127.0.0.1:8200"
export VAULT_TOKEN="s.xxxxx"

# 시크릿 저장
vault kv put secret/app db_password="p@ssw0rd" api_key="abcd1234"

# 시크릿 조회
vault kv get secret/app

The expected output looks like this.

===== Data =====
Key             Value
---             -----
api_key         abcd1234
db_password     p@ssw0rd

KV v2 supports versioning and distinguishes deletion, recovery, and permanent deletion. If typos or incorrect updates happen frequently during operations, v2 is much safer.

Transit Secrets Engine: Keys in Vault, Data Outside

Transit is an encryption service. Data remains in the application or DB, while Vault handles only key storage and encryption/decryption operations. The biggest difference is that Vault does not store the plaintext.

Key Characteristics

• Data location: External systems such as the application/DB
• Access pattern: Encryption/decryption/signing/verification API calls
• Keys remain inside Vault, with support for key rotation and re-encryption (rewrap)
• Service availability and latency directly affect application performance

Example: Basic Transit Operations

# 키 생성
vault write -f transit/keys/payments

# 평문을 base64로 인코딩해서 암호화 요청
PLAINTEXT=$(printf 'card-1234' | base64)
vault write transit/encrypt/payments plaintext="$PLAINTEXT"

The expected output looks like this.

Key         Value
---         -----
ciphertext  vault:v1:AbCdEf...==

Decryption takes ciphertext and returns base64-encoded plaintext.

vault write transit/decrypt/payments ciphertext="vault:v1:AbCdEf...=="

Key       Value
---       -----
plaintext Y2FyZC0xMjM0

KV vs Transit Comparison

Selection Criteria: When to Use KV or Transit

• When KV fits

  • You need the values themselves, such as application settings or tokens.
  • You want centralized access control and audit logging in a central store.
  • Consistent secret management takes priority over data encryption.

• When Transit fits

  • You want to keep data outside and centrally control only the keys.
  • You have a large volume of data, as with DB field-level encryption.
  • Automated key rotation and re-encryption matter.

• When to use both

  • Manage application settings and credentials with KV
  • Use Transit to encrypt sensitive data (such as PII).

Operational Checklist (Delegate → Review → Own)

In practice, security reliability depends on who automates what and who holds final responsibility.

• Delegate: Automate policy templates, mount structure, and standard path conventions.
• Review: Security staff review policy scope and adherence to the principle of least privilege.
• Own: The service owner makes the final decisions on key rotation policies and incident response.

Map of Open-Source Options

Vault's KV/Transit concepts are widely known, but the open-source ecosystem takes various approaches. The following list groups options by KV storage and Transit-style encryption services.

KV-Based Secret Stores

Transit-Style Encryption Services

GitOps/File-Based Encryption (Supporting Tools)

For open-source software, maintenance matters as much as features. Check release cadence and community activity before adopting a tool.