Vault-cli is a project to have a light-weight, secure and multi-tenant solution for encrypted password storage. Is uses the Vault Rest API where you can manage your environments, tokens and secrets.

Security is key in the project. All Secure Vaults use unique encryption keys, which are never stored in the database and are only available to the customer.

Release:

Last build:

Last release:

Tokens

There are 3 types of tokens, each having its own purpose. The token received from the

	EnvironmentAdmin	ReadWrite	ReadOnly
Manage tokens	✅
Manage secrets		✅
Get decrypted secret		✅	✅

The initial token received when a Secure Vault via the Previder Portal is created is of the type EnvironmentAdmin. This type of token can be used to manage ReadWrite or ReadOnly tokens, but not secrets. An additional token of the type EnvironmentAdmin can also be created. Use the following command to create a token of type EnvironmentAdmin.

./vault-cli -t <insert-token> token create --description "EnvironmentAdmin token" --type EnvironmentAdmin

Getting started

Vault-cli is a stand-alone binary to use with the Vault API.

To see all usages, run

./vault-cli --help

The token can be used via the command-line itself.

./vault-cli -t <insert-token> secret list

To use a more secure method, set the token as an environment variable once to use it with the client.

export VAULT_TOKEN="insert-token"
./vault-cli secret list

Creating tokens for secret management

ReadWrite token

A ReadWrite type token can create, list, get, delete and decrypt secrets. To create a ReadWrite token using the EnvironmentAdmin token, run the following command:

./vault-cli token create --description "ReadWrite token" --type ReadWrite

ReadOnly token

A ReadOnly type token can only decrypt secrets of which an id or name are known. This type cannot manage secrets. To create a ReadOnly token for use in a cluster, run the following command:

./vault-cli token create --description "ReadOnly token" --type ReadOnly

Usage examples

List all tokens

Only available to EnvironmentAdmin type tokens

./vault-cli token list

List all secrets

Only available to ReadWrite type tokens

./vault-cli secret list

Create a secret

Only available to ReadWrite type tokens

./vault-cli secret create --description "Example secret" --secret "SuperSecurePassword"

Delete a secret

Only available to ReadWrite type tokens

./vault-cli secret delete <id or description of the secret>

Decrypt a secret

Only available to ReadWrite and ReadOnly type tokens

./vault-cli secret decrypt <id or description of the secret>

To get the decrypted secret back to use in an application.

Output

The default output format is json. Lists of environments, tokens and secrets can also be pretty-printed with the -o pretty parameter.