1337skills.com

Appearance

Vault ​

Comprehensive HashiCorp Vault commands and workflows for secrets management, encryption, and secure access to sensitive data.

Installation & Setup ​

CommandDescription
vault versionShow Vault version
vault server -devStart development server
vault server -config=config.hclStart with configuration file
vault statusCheck server status

Authentication & Login ​

Basic Authentication ​

CommandDescription
vault auth -method=userpass username=myuserLogin with username/password
vault auth -method=ldap username=myuserLogin with LDAP
vault auth -method=github token=mytokenLogin with GitHub
vault auth -method=awsLogin with AWS IAM
vault auth -method=kubernetesLogin with Kubernetes

Token Management ​

CommandDescription
vault token createCreate new token
vault token create -ttl=1hCreate token with TTL
vault token lookupLook up current token
vault token renewRenew current token
vault token revoke TOKENRevoke specific token

Secrets Management ​

Key-Value Secrets (v2) ​

CommandDescription
vault kv put secret/myapp username=admin password=secretStore secret
vault kv get secret/myappRetrieve secret
vault kv get -field=password secret/myappGet specific field
vault kv delete secret/myappDelete secret
vault kv list secret/List secrets
vault kv metadata get secret/myappGet metadata

Secret Versions ​

CommandDescription
vault kv put secret/myapp @data.jsonStore from JSON file
vault kv get -version=2 secret/myappGet specific version
vault kv rollback -version=1 secret/myappRollback to version
vault kv destroy -versions=2,3 secret/myappDestroy versions
vault kv undelete -versions=2 secret/myappUndelete versions

Database Secrets Engine ​

Database Configuration ​

CommandDescription
vault secrets enable databaseEnable database engine
vault write database/config/my-mysql-database plugin_name=mysql-database-plugin connection_url=":@tcp(localhost:3306)/" allowed_roles="my-role" username="vaultuser" password="vaultpass"Configure MySQL
vault write database/roles/my-role db_name=my-mysql-database creation_statements="CREATE USER ''@'%' IDENTIFIED BY '';GRANT SELECT ON *.* TO ''@'%';" default_ttl="1h" max_ttl="24h"Create role

Dynamic Credentials ​

CommandDescription
vault read database/creds/my-roleGenerate database credentials
vault write database/rotate-root/my-mysql-databaseRotate root credentials

PKI (Public Key Infrastructure) ​

PKI Setup ​

CommandDescription
vault secrets enable pkiEnable PKI engine
vault secrets tune -max-lease-ttl=87600h pkiSet max TTL
vault write pki/root/generate/internal common_name=example.com ttl=87600hGenerate root CA
vault write pki/config/urls issuing_certificates="http://vault.example.com:8200/v1/pki/ca" crl_distribution_points="http://vault.example.com:8200/v1/pki/crl"Configure URLs

Certificate Management ​

CommandDescription
vault write pki/roles/example-dot-com allowed_domains=example.com allow_subdomains=true max_ttl=72hCreate role
vault write pki/issue/example-dot-com common_name=test.example.comIssue certificate
vault write pki/revoke serial_number=39:dd:2e:90:b7:23:1f:8d:d3:7d:31:c5:1b:da:84:d0:5b:65:31:58Revoke certificate

AWS Secrets Engine ​

AWS Configuration ​

CommandDescription
vault secrets enable awsEnable AWS engine
vault write aws/config/root access_key=AKIAI... secret_key=R4nm...Configure root credentials
vault write aws/roles/my-role credential_type=iam_user policy_document=-<<EOF {...} EOFCreate IAM role

AWS Credentials ​

CommandDescription
vault read aws/creds/my-roleGenerate AWS credentials
vault write aws/sts/my-role ttl=15mGenerate STS credentials

Transit Secrets Engine ​

Encryption Setup ​

CommandDescription
vault secrets enable transitEnable transit engine
vault write transit/keys/my-key type=aes256-gcm96Create encryption key
vault write transit/encrypt/my-key plaintext=$(base64 <<< "my secret data")Encrypt data
vault write transit/decrypt/my-key ciphertext=vault:v1:8SDd3WHDOjf7mq69CyCqYjBXAiQQAVZRkFM13ok481zoCmHnSeDX9vyf7w==Decrypt data

Key Management ​

CommandDescription
vault write transit/keys/my-key/rotateRotate encryption key
vault read transit/keys/my-keyRead key information
vault write transit/rewrap/my-key ciphertext=vault:v1:...Rewrap with latest key

Policies ​

Policy Management ​

CommandDescription
vault policy write my-policy policy.hclCreate/update policy
vault policy read my-policyRead policy
vault policy listList all policies
vault policy delete my-policyDelete policy

Example Policy ​

hcl
# Read operation on the k/v secrets
path "secret/data/*" {
  capabilities = ["read"]
}

# Write operation on the k/v secrets
path "secret/data/myapp/*" {
  capabilities = ["create", "update"]
}

# Deny all access to secret/admin
path "secret/data/admin" {
  capabilities = ["deny"]
}

Auth Methods ​

Enable Auth Methods ​

CommandDescription
vault auth enable userpassEnable username/password
vault auth enable ldapEnable LDAP
vault auth enable githubEnable GitHub
vault auth enable awsEnable AWS IAM
vault auth enable kubernetesEnable Kubernetes

Configure Auth Methods ​

CommandDescription
vault write auth/userpass/users/myuser password=mypass policies=my-policyCreate user
vault write auth/ldap/config url="ldap://ldap.example.com" userdn="ou=Users,dc=example,dc=com"Configure LDAP
vault write auth/github/config organization=myorgConfigure GitHub

Audit Logging ​

Enable Audit Devices ​

CommandDescription
vault audit enable file file_path=/vault/logs/audit.logEnable file audit
vault audit enable syslogEnable syslog audit
vault audit listList audit devices
vault audit disable file/Disable audit device

High Availability & Clustering ​

Cluster Operations ​

CommandDescription
vault operator initInitialize Vault cluster
vault operator unsealUnseal Vault
vault operator sealSeal Vault
vault operator step-downStep down as leader
vault operator raft list-peersList Raft peers

Backup & Recovery ​

CommandDescription
vault operator raft snapshot save backup.snapCreate snapshot
vault operator raft snapshot restore backup.snapRestore snapshot

Configuration Examples ​

Server Configuration ​

hcl
storage "consul" {
  address = "127.0.0.1:8500"
  path    = "vault/"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1
}

api_addr = "http://127.0.0.1:8200"
cluster_addr = "https://127.0.0.1:8201"
ui = true

Auto-unseal with AWS KMS ​

hcl
seal "awskms" {
  region     = "us-east-1"
  kms_key_id = "12345678-1234-1234-1234-123456789012"
}

Environment Variables ​

VariableDescription
VAULT_ADDRVault server address
VAULT_TOKENAuthentication token
VAULT_NAMESPACEVault namespace (Enterprise)
VAULT_CACERTCA certificate file
VAULT_CLIENT_CERTClient certificate file
VAULT_CLIENT_KEYClient private key file

Best Practices ​

Security ​

  1. Enable TLS: Always use TLS in production
  2. Least Privilege: Grant minimal required permissions
  3. Token TTL: Use short-lived tokens
  4. Audit Logging: Enable comprehensive audit logging
  5. Seal/Unseal: Implement proper seal/unseal procedures

Operations ​

  1. High Availability: Deploy in HA mode for production
  2. Backup Strategy: Regular snapshots and backups
  3. Monitoring: Monitor Vault health and performance
  4. Rotation: Regular key and credential rotation
  5. Access Patterns: Monitor and analyze access patterns

Development ​

  1. Dev Mode: Use dev mode only for development
  2. Policy Testing: Test policies thoroughly
  3. Secret Versioning: Use secret versioning for rollbacks
  4. Integration: Integrate with CI/CD pipelines
  5. Documentation: Document secret paths and policies