In my opinion, the best features with HashiCorp Vault are that it works as one solution providing security across all the clouds. I can have a cipher that's inside of HashiCorp Vault, and I can also have a separate secret inside of my cloud Vault, depending on which cloud it is. You can't get to the second secret without the first secret. This provides better protection because an employee of the cloud provider can't hack your system. We also use it for encryption. We use it to store encryption keys. Regarding HashiCorp Vault's identity-based access controls, I believe it's sufficient for managing and mitigating risk. It has multi-factor authentication and everything that we'd expect. HashiCorp Vault's auditing features meet my compliance needs. By having the secret, or at least the access secret outside of the cloud provider's access, they cannot access it. If you think about it from an encryption standpoint, if I encrypt the data before it ever hits the cloud provider's network using the encryption key that's stored inside of HashiCorp Vault, then the cloud provider encrypts it again. Now it's dual-encrypted. It's actually encrypted more than that, but we'll just say dual-encrypted. Neither HashiCorp nor the cloud provider can decrypt it without having both secrets.
