If you successfully completed the steps in Starting the
Server, you started the dev server and
exported the VAULT_TOKEN
to the initial root token value so that vault login
is not required to authenticate. If you have not yet completed those steps,
please review that tutorial and do so before proceeding here.
Now that the dev server is up and running, let's get straight to it and read and write your first secret.
One of the core features of Vault is the ability to read and write arbitrary secrets securely. Secrets written to Vault are encrypted and then written to backend storage. Therefore, the backend storage mechanism never sees the unencrypted value and doesn't have the means necessary to decrypt it without Vault.
NOTE: An interactive tutorial is also available to perform the steps described in this tutorial. Click the Show Terminal button to start.
»Writing a Secret
Let's write a secret to Key/Value v2 secrets
engine when running a dev
server. Use the vault kv put <path> <key>=<value>
command.
$ vault kv put secret/hello foo=world
Key Value
--- -----
created_time 2020-09-02T21:40:01.635656Z
deletion_time n/a
destroyed false
version 1
This writes the pair foo=world
to the path secret/hello
. You'll
learn paths in more detail later, but for now it is important that the
path is prefixed with secret/
, otherwise this example won't work. The
secret/
prefix is where arbitrary secrets can be read and written.
You can even write multiple pieces of data.
$ vault kv put secret/hello foo=world excited=yes
Key Value
--- -----
created_time 2020-09-02T21:41:17.568155Z
deletion_time n/a
destroyed false
version 2
Notice that the version
is now 2
. The vault kv put
command creates a new
version of the secrets and replaces any pre-existing data at the path if any.
Warning: The examples in this tutorial use the <key>=<value>
input to
send secrets to Vault. However, sending data as a part of the CLI command often
end up in the shell history unencrypted. To avoid this, refer to the Static
Secrets: Key/Value Secrets
Engine
tutorial to learn different approaches.
»Getting a Secret
As you might expect, secrets can be retrieved with vault kv get <path>
.
$ vault kv get secret/hello
====== Metadata ======
Key Value
--- -----
created_time 2020-09-02T21:41:17.568155Z
deletion_time n/a
destroyed false
version 2
===== Data =====
Key Value
--- -----
excited yes
foo world
Vault returns the latest version (in this case version 2
) of the secrets at
secret/hello
.
To print only the value of a given field, use the -field=<key_name>
flag.
$ vault kv get -field=excited secret/hello
yes
Optional JSON output is very useful for scripts. For example, you can use the
jq
tool to extract the value of the excited
secret.
$ vault kv get -format=json secret/hello | jq -r .data.data.excited
yes
»Deleting a Secret
Now that you've learned how to read and write a secret, let's go ahead
and delete it. You can do so using the vault kv delete
command.
$ vault kv delete secret/hello
Success! Data deleted (if it existed) at: secret/hello
»Next
In this tutorial, you learned how to use the powerful CRUD features of Vault to store arbitrary secrets. On its own, this is already a useful but basic feature.
To learn more, go through the following tutorials:
But for now, continue to the Secrets Engine tutorial for a quick tour of Vault secrets engine.