Patch one KV field

Update one field without rewriting the whole secret; note: kv patch needs KV-v2

vault kv patch -mount=secret app api_key=<id>
tool
vault31 commands
tags
vaultsecretstroubleshooting

More vault commands

  • Response wrapping handoff
    T=$(vault kv get -wrap-ttl=60s -field=wrapping_token -mount=secret app); vault unwrap $T

    Pass a secret as a single-use wrapping token; note: any reuse trips a security alarm

  • Check token path capabilities
    vault token capabilities database/creds/readonly

    Show effective ACL verbs the current token has on a path; fast policy debugging

  • Revoke a dynamic lease
    vault lease revoke -prefix database/creds/readonly

    Revoke all leases under a prefix to kill leaked dynamic DB creds instantly

  • Login with token
    vault login <token>

    Authenticate to Vault using a token

  • Login with AppRole
    vault write auth/approle/login role_id=<role> secret_id=<secret>

    Authenticate via AppRole auth method

all 31 vault commands