Case Study: The New York Times achieves dynamic Fastly secret management with HashiCorp Vault

Vault Fastly Secret Engine Design and Integration at The New York Times

The New York Times worked with HashiCorp to improve management of the many Fastly tokens used across its services. As the number of static tokens grew across dev, staging, and production environments, token sprawl, manual rotation, and reliance on plaintext storage in the CI/CD pipeline created security and operational burdens.

HashiCorp Vault was used to store credentials securely and, through a custom Vault Fastly Secret Engine, generate dynamic, short-lived Fastly tokens on demand. The solution also handled MFA via TOTP and integrated into Drone-based CI/CD, reducing manual secret rotation and eliminating the need to manage over 100 long-lived tokens.

The New York Times

Ling Zhang

Software Developer