Postmortem: A Misconfigured AWS IAM Roles Anywhere Caused a Data Leak in Our Vault 1.14 Cluster

On March 12, 2024, our 12-node HashiCorp Vault 1.14.3 cluster leaked 14,728 sensitive customer PII records over 47 minutes due to a single misconfigured trust anchor in AWS IAM Roles Anywhere. The breach cost $2.1M in regulatory fines, 3 enterprise c...