»What is a secrets engine?
Secrets engines are Vault components which store, generate or encrypt secrets. In Your First Secrets tutorial, you used key/value v2 secrets engine to store data. Some secrets engines like key/value secrets engine simply store and read data. Other secrets engines connect to other services and generate dynamic credentials on demand. Other secrets engines provide encryption as a service.
There are a number of secrets engines available. You can think of them as a plugin. Enable the secrets engine that meets your security needs.
Secrets Management has a tutorial for different secrets engines. But first, complete this tutorial to learn the basic commands.
In Your First Secrets tutorial,
all requests started with secret/
. The key/value v2 secrets engine was enabled
at secret/
by default that it was ready to receive requests (e.g. write a new
data).
Try the following command which will result an error:
The path prefix tells Vault which secrets engine to which it should route traffic. When a request comes to Vault, it matches the initial path part using a longest prefix match and then passes the request to the corresponding secrets engine enabled at that path. Vault presents these secrets engines similar to a filesystem.
This tutorial discusses secrets engines and the operations they support. This information is important to both operators who will configure Vault and users who will interact with Vault.
»Enable a secrets engine
To get started, enable the kv
secrets engine. Each path is completely isolated
and cannot talk to other paths. For example, a kv
secrets engine enabled at
foo
has no ability to communicate with a kv
secrets engine enabled at bar
.
The path where the secrets engine is enabled defaults to the name of the secrets engine. Thus, the following command is equivalent to executing the above command.
Executing this command will throw the path is already in use at kv/
error.
To verify our success and get more information about the secrets engine, use the
vault secrets list
command:
This shows there are 4 enabled secrets engines on this Vault server. You can see the type of the secrets engine, the corresponding path, and an optional description (or "n/a" if none was given).
The sys/
path corresponds to the system backend. These paths interact with
Vault's core system and are not required for beginners.
Take a few moments to read and write some data to the new kv
secrets engine
enabled at kv/
. Here are a few ideas to get started.
To create secrets, use the kv put
command.
To read the secrets stored in the kv/hello
path, use the kv get
command.
Create secrets at the kv/my-secret
path.
Read the secrets at kv/my-secret
.
Delete the secrets at kv/my-secret
.
List existing keys at the kv
path.
»Disable a secrets engine
When a secrets engine is no longer needed, it can be disabled. When a secrets engine is disabled, all secrets are revoked and the corresponding Vault data and configuration is removed.
Note that this command takes a PATH to the secrets engine as an argument, not the TYPE of the secrets engine.
Any requests to route data to the original path would result in an error, but another secrets engine could now be enabled at that path.
»Next
Vault behaves similarly to a virtual filesystem. The read/write/delete/list operations are forwarded to the corresponding secrets engine, and the secrets engine decides how to react to those operations.
This abstraction is incredibly powerful. It enables Vault to interface directly with physical systems, databases, HSMs, etc. But in addition to these physical systems, Vault can interact with more unique environments like AWS IAM, dynamic SQL user creation, etc. all while using the same read/write interface.
You learned the basics of the vault secrets
command. This is important
knowledge to move forward and explore other secrets engines.