vault commands

31 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 31 shown

  • Login with token
    vault login <token>

    Authenticate to Vault using a token

  • Login with AppRole
    vault write auth/approle/login role_id=<role> secret_id=<secret>

    Authenticate via AppRole auth method

  • KV get secret
    vault kv get -mount=secret path/to/secret

    Read a KV v2 secret; add -format=json for scripting

    secrets

  • KV put secret
    vault kv put -mount=secret path/to/secret key=value

    Write or update a KV v2 secret

    secrets

  • KV list secrets
    vault kv list -mount=secret path/to/

    List all keys under a KV path

    secrets

  • KV delete secret
    vault kv delete -mount=secret path/to/secret

    Soft-delete the latest version of a KV secret

    secrets

  • KV metadata — secret history
    vault kv metadata get -mount=secret path/to/secret

    See all versions, creation dates, deletion status

    secrets

  • Create token with policy
    vault token create -policy=read-only -ttl=1h

    Issue a short-lived token limited to a specific policy

  • List auth methods
    vault auth list

    Show all enabled auth backends in Vault

  • Enable Kubernetes auth
    vault auth enable kubernetes && vault write auth/kubernetes/config kubernetes_host=https://$KUBERNETES_PORT_443_TCP_ADDR:443

    Enable and configure Kubernetes auth method

    config

  • Create Kubernetes role
    vault write auth/kubernetes/role/my-role bound_service_account_names=<sa> bound_service_account_namespaces=<ns> policies=<policy> ttl=1h

    Bind a k8s ServiceAccount to a Vault policy

    config

  • Write policy
    vault policy write my-policy policy.hcl

    Upload an HCL policy file to Vault

    config

  • List policies
    vault policy list

    List all policies in Vault

  • Enable secrets engine
    vault secrets enable -path=myapp kv-v2

    Mount a new secrets engine at a given path

    config

  • Transit encrypt
    vault write transit/encrypt/my-key plaintext=$(echo -n 'secret' | base64)

    Encrypt data using Vault's transit encryption engine

    secrets

  • Transit decrypt
    vault write transit/decrypt/my-key ciphertext=vault:v1:... | base64 -d

    Decrypt a ciphertext with transit engine

    secrets

  • Token lookup self
    vault token lookup

    Show TTL, policies, and capabilities of current token

  • Renew token
    vault token renew

    Extend the current token's TTL

  • Vault status
    vault status

    Show seal status, HA mode, cluster info

    debug

  • Enable KV v2 secrets engine
    vault secrets enable -path=secret kv-v2

    Mount a KV version 2 secrets engine at 'secret/'

    security

  • Write a secret
    vault kv put secret/myapp/config db_password=s3cr3t api_key=abc123

    Store multiple key-value pairs at a path

    security

  • Read a secret
    vault kv get -format=json secret/myapp/config | jq '.data.data'

    Read a KV v2 secret and extract the data payload

    security

  • List secrets at path
    vault kv list secret/myapp/

    List all keys under a KV v2 prefix

    security

  • Create periodic token
    vault token create -policy=read-only -period=24h -display-name=ci-pipeline

    Issue a renewable token with a 24h TTL for CI

    security · ci

  • Enable Kubernetes auth method
    vault auth enable kubernetes && vault write auth/kubernetes/config kubernetes_host=https://kubernetes.default.svc

    Allow pods to authenticate with Vault via ServiceAccount JWT

    security · kubectl

  • Generate dynamic DB credentials
    vault read database/creds/readonly-role

    Obtain short-lived Postgres credentials from the database secrets engine

    security · postgres

  • Seal / unseal Vault
    vault operator seal vault operator unseal $UNSEAL_KEY

    Manually seal or unseal Vault with an unseal key shard

    security

  • Patch one KV field
    vault kv patch -mount=secret app api_key=<id>

    Update one field without rewriting the whole secret; note: kv patch needs KV-v2

    secrets · troubleshooting

  • Response wrapping handoff
    T=$(vault kv get -wrap-ttl=60s -field=wrapping_token -mount=secret app); vault unwrap $T

    Pass a secret as a single-use wrapping token; note: any reuse trips a security alarm

    secrets · security · troubleshooting

  • Check token path capabilities
    vault token capabilities database/creds/readonly

    Show effective ACL verbs the current token has on a path; fast policy debugging

    security · troubleshooting · observability

  • Revoke a dynamic lease
    vault lease revoke -prefix database/creds/readonly

    Revoke all leases under a prefix to kill leaked dynamic DB creds instantly

    security · troubleshooting · secrets