I configured a business application to access the vault to get the password to connect to the database (classic usecase)
This application is located on a VM that is accesible by the application manager.
Of course the application has an external configuration file containing the vault token…
What are the best practices to avoid a person (that has access to this VM) using the token to connect to the vault and get the password DB ?
I guess we need a dedicated service account for lauching the application with specific permissions on the configuration file ? But what happens with a root user…
What are the other possibilities ?
Thank you for your help