Secret Commands
- vault kv putWrite secret
- vault kv getRead secret
- vault kv listList secrets
- vault kv deleteDelete secret
- vault kv metadataSecret metadata
Auth Methods
- tokenToken auth
- userpassUsername/password
- ldapLDAP/AD
- approleMachine auth
- kubernetesK8s service acct
- awsAWS IAM/EC2
Secrets Engines
- kvKey-value store
- databaseDynamic DB creds
- awsDynamic AWS creds
- pkiCertificates
- transitEncryption as svc
- sshSSH credentials
Operator Commands
- vault operator initInitialize
- vault operator unsealUnseal vault
- vault operator sealSeal vault
- vault statusCheck status
KV Secrets Engine
# Enable KV v2 secrets engine
vault secrets enable -path=secret kv-v2
# Write a secret
vault kv put secret/myapp \
username="admin" \
password="s3cr3t"
# Read a secret
vault kv get secret/myapp
vault kv get -field=password secret/myapp
# Read specific version
vault kv get -version=2 secret/myapp
Policy (HCL)
# myapp-policy.hcl
path "secret/data/myapp/*" {
capabilities = ["create", "read", "update", "delete", "list"]
}
path "secret/metadata/myapp/*" {
capabilities = ["list"]
}
# Apply policy
vault policy write myapp-policy myapp-policy.hcl
Token Commands
- vault token createCreate token
- vault token lookupToken info
- vault token renewExtend TTL
- vault token revokeRevoke token
- vault loginAuthenticate
AppRole Auth
# Enable AppRole
vault auth enable approle
# Create role
vault write auth/approle/role/myapp \
policies="myapp-policy" \
token_ttl=1h
# Get role-id and secret-id
vault read auth/approle/role/myapp/role-id
vault write -f auth/approle/role/myapp/secret-id
# Login
vault write auth/approle/login \
role_id="..." secret_id="..."
Database Secrets Engine
# Enable database secrets engine
vault secrets enable database
# Configure PostgreSQL
vault write database/config/mydb \
plugin_name=postgresql-database-plugin \
connection_url="postgresql://{{username}}:{{password}}@localhost:5432/mydb" \
allowed_roles="my-role" \
username="vault" password="..."
# Create role with TTL
vault write database/roles/my-role db_name=mydb \
creation_statements="CREATE ROLE..." default_ttl=1h
# Get dynamic credentials
vault read database/creds/my-role
Capabilities
- createCreate data
- readRead data
- updateUpdate data
- deleteDelete data
- listList paths
- sudoRoot-protected
Environment Variables
- VAULT_ADDRServer URL
- VAULT_TOKENAuth token
- VAULT_NAMESPACENamespace
- VAULT_CACERTCA certificate