Secret Manager

KV Secret Engine

The KV (Key-Value) Secret Engine is Vault's default secrets engine, ideal for storing arbitrary secrets such as API keys, passwords, or configuration values. It serves as a secure alternative to traditional environment files.

Enabling the KV Secret Engine

export VAULT_ADDR='http://127.0.0.1:8200'

vault login

vault secrets enable -path=secret -version=2 kv

If you wish to disable the KV Secret Engine, you can do so by running the following command :

vault secrets disable secret

Managing Secrets in KV

In this section, we will learn how to store, read, update, and delete secrets, as well as manage secret versions.

Storing Secrets

To store secrets in the newly enabled KV Secret Engine, use the following command :

vault kv put secret/{name_secret} mykey=myvalue

And now, you have successfully saved your first secret !

Reading Secrets

To read a secret stored in the KV Secret Engine, use the following command :

vault kv get secret/{name_secret}

Updating Secrets

To update an existing secret in the KV Secret Engine, use the same vault kv put command with the new key-value pairs. For example :

vault kv put secret/{name_secret} mykey=newvalue

Deleting Secrets

To delete a secret from the KV Secret Engine, use the following command :

vault kv delete secret/{name_secret}

Deleting Versions of a Secret

To delete a specific version of a secret in the KV Secret Engine, use the following command :

vault kv delete -version=1,2 secret/{name_secret}

Or, if you want to permanently remove all versions and metadata for a secret, use :

vault kv metadata delete secret/{name_secret}

Identity Secret Engine

The Identity Secret Engine in Vault manages users, groups, and metadata for fine-grained access control and integration with external identity providers.

Enabling the Userpass

To allow users to authenticate with a username and password, you need to enable the userpass authentication method. Run the following command :

vault auth enable userpass

To disable the userpass authentication method, use the following command :

vault auth disable userpass

Managing the User

This section covers how to manage identities using the Vault Identity Secret Engine. You will learn how to create users, assign groups, and manage metadata for fine-grained access control.

Creating a User

To create a new user, use the following command :

vault write auth/userpass/users/{name_user} password="password123"

Changing a User's Password

To change the password for an existing user, use the following command :

vault write auth/userpass/users/{name_user} password="new_password"

Assigning Policies

To assign policies to a user, use the following command :

vault write auth/userpass/users/{name_user} policies="policy1, policy2"

Listing Users

To list all users managed by the userpass authentication method, use the following command :

vault list auth/userpass/users

Reading User Parameters

To read the parameters of a user in the userpass authentication method, use the following command :

vault read auth/userpass/users/{name_user}

Deleting a User

To delete a user from the userpass authentication method, use the following command :

vault delete auth/userpass/users/{name_user}