Working with secrets engines

A secrets engine is a component that stores, generates, or encrypts data. You enable and configure secrets engines in your Vault Dedicated instance using the Vault UI, CLI, or API.

Supported secrets engines

During the public beta, Vault Dedicated supports the following secrets engines:

Supported secrets engines for Vault Dedicated
Secrets engine What it does HashiCorp docs
KV v2 Store and retrieve arbitrary static secrets as key-value pairs, with versioning support. KV secrets engine v2
Transit Encryption-as-a-service: encrypt, decrypt, sign, verify, and derive keys without key material leaving Vault. Transit secrets engine
PKI (internal CA) Issue and manage X.509 certificates using an internal private key hierarchy. PKI secrets engine
PKI external CA Issue certificates signed by an external certificate authority, with support for Let's Encrypt and DigiCert. PKI secrets engine - external CA
Transform Tokenize, encode, and format sensitive data to protect it while preserving its structure. Transform secrets engine
TOTP Generate and validate time-based one-time passwords (TOTP) for multi-factor authentication. TOTP secrets engine

Before you begin

Before you enable a secrets engine, ensure that you have:

Enabling a secrets engine

Use the Vault CLI or API to enable a secrets engine on your instance. The following example enables the KV v2 secrets engine.

  1. Authenticate to your Vault Dedicated instance using your admin token.

    export VAULT_ADDR="https://<instance_id>.vault.<region>.secrets-manager.appdomain.cloud"
export VAULT_TOKEN="<admin_token>"

  2. Enable the secrets engine at a path.

    vault secrets enable -path=secret kv-v2

  3. Write a secret.

    vault kv put secret/myapp/config username="myuser" password="mypassword"

  4. Read the secret.

    vault kv get secret/myapp/config

For full configuration options and examples for each secrets engine, see the HashiCorp Vault secrets engines documentation.

Next steps