Hashicorp Vault Integration (Token) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	7 / 20	8 / 10	61 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides multiple examples: basic configuration with token, and a version-specific CLI installation example. Both show sensible defaults and cover the major modes of operation.
Coder-context framing	8	1	Mentions "in your Coder workspaces" once but does not explain what the module adds on top of Coder or show where Coder fits in the Vault authentication flow. No explanation of how Coder orchestrates the token injection or CLI installation.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference in frontmatter.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	The vault_token variable is marked sensitive = true in main.tf. README examples use var.token references without inlining literal secrets.
Non-hardcoded auth path	4	2	README shows creating a Vault token via CLI (vault token create -policy="read-coder-secrets"), which requires manual token generation and pasting. No mention of ServiceAccount, OAuth, or other non-manual auth paths. Partial credit for documenting policy-based token creation.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The download URL https://releases.hashicorp.com/vault/... is hardcoded in run.sh. No module input variable allows overriding this URL to point to an internal mirror. The vault_cli_version variable only controls version selection, not the source URL.
Bring-your-own binary	5	5	The script checks if command -v vault and skips installation if the correct version is already present: "Vault version X is already installed and up-to-date." This effectively supports pre-baked binaries.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The HashiCorp releases URL appears only in source code (run.sh), not documented for restricted environments.
Runs without sudo	2	2	The run.sh script attempts sudo mv vault /usr/local/bin/vault but falls back to ~/.local/bin/vault when sudo fails, with a note to add to PATH. Core functionality works without sudo via the fallback path.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. vault_cli_version has a validation rule for format `^(latest
Test coverage	4	2	main.test.ts exists and runs runTerraformInit plus testRequiredVariables for agent_id and vault_addr. However, no .tftest.hcl file present, and TypeScript tests only cover basic initialization, not business logic or end-to-end behavior.

Overall — 61 / 100

Raw 46 / 75 → round(46 / 75 × 100) = 61

---

Scored against SCORECARD.md on 2026-07-15 with claude-sonnet-4-5.