HashiCorp Vault centralizes passwords, certificates, keys, and other secrets so applications can request them without storing local copies. Its secret rotation and versioning capabilities extend beyond Airflow’s built-in variables and connections. section 16.5
Airflow accesses Vault through its secrets backend while DAG code continues using ordinary connection and variable interfaces. Configure the backend with AIRFLOW__SECRETS__BACKEND and AIRFLOW__SECRETS__BACKEND_KWARGS; Vault paths use a shared prefix, connections use conn_uri, and variables use value. section 16.5
Fetch an HTTP connection without embedding credentials
Store the connection at a path such as secret/connections/secure_api, then let an HttpOperator reference http_conn_id="secure_api". The DAG contains no explicit Vault reference; the configured backend resolves the connection details.
