HOW (AND WHY) TO USE APPROLE CORRECTLY IN HASHICORP VAULT

Summary from the TLDR InfoSec newsletter

Vault AppRoles aim to solve the “Secret Zero” problem in systems that don't have native Vault authentication capabilities by splitting authentication into two components: a role ID and secret ID. The role ID is not sensitive and the secret ID is a time limited credential that should only be provided to the application at the expected time of use. Vault also supports wrapping the secret ID to decrease exposure. The Vault agent can automate AppRole authentication in applications that cannot be modified.