Vault Auth to return only token

[martinssipenko]

Hi,

Is there a way to make vault auth return only the token in output? I'd like to use Vault CLI to authenticate my EC2 instance using AWS Backend, but I'd like to avoid writing custom code for this particular use case. I'm aware that Vault API could be used, however with AWS Auth backend it's not so trivial.

Perhaps it would be possible to add some sort of flag, that would just return the token, or add a flag using which the output would be machine readable?

[jefferai]

Hi @martinssipenko

The reason there isn't a format flag right now is that we return a lot of other textual information to clients, since it's meant to be for humans.

One possibility would be a pretty trivial grep/sed to pull the token out, since there is known text in front and a newline after.

Another might be to add a flag specifically to the AWS CLI helper that will return the encoded JSON that needs to be sent to Vault. Then you could use the CLI to get the headers and pipe that into a curl call, and have the output of that go to jq or so.

[spkane]

This works nowadays:

vault write --field=token auth/approle/login role_id=REDACTED secret_id=REDACTED