Setting up your Vault Dedicated instance

In this tutorial, you learn how to set up a Vault Dedicated plan instance of IBM Cloud® Secrets Manager by provisioning the instance, retrieving its endpoints, generating an admin token, and signing in to the Vault UI for initial configuration.

The Vault Dedicated plan delivers Vault Enterprise as a managed service in IBM Cloud. After your instance is provisioned, you can use the instance dashboard to find connection details and open the Vault UI to begin configuring your Vault environment.

The Vault Dedicated plan is currently available as a public beta. Beta features are provided for evaluation and testing purposes and have limitations compared to generally available features.

Vault Dedicated public beta limitations

During the public beta period, the Vault Dedicated plan has the following temporary restrictions:

  • Instance limit: Only 1 Vault Dedicated instance per account during beta.
  • No upgrade path: Cannot upgrade from beta to GA. All beta instances will be deleted before general availability.
  • Regional availability: Available in Dallas and Frankfurt.
  • Free during beta: No charges apply during the beta period.
  • Beta to GA migration: Data migration from beta instances to GA instances is not supported.

These limitations are temporary and apply only during the public beta period. It will be removed or modified when the Vault Dedicated plan reaches general availability.

Before you begin

Before you begin, make sure that you have an IBM Cloud account and the required IAM access to work with the service.

You need the following roles:

Provision a Vault Dedicated plan instance

Create a Vault Dedicated plan instance from the IBM Cloud catalog.

  1. In the IBM Cloud console, go to the Catalog.

  2. Select Secrets Manager.

  3. Choose the Vault Dedicated plan.

  4. Configure the instance:

    • Select a deployment region.
    • Enter a unique instance name.
    • Select a resource group.
    • Choose either service-managed encryption or customer-managed encryption by using Key Protect.
    • Select private-only endpoints, or enable a public endpoint if required.

    If you select private-only endpoints, note the following requirements before you try to connect:

    If you plan to use both Standard and Vault Dedicated plan instances, adopt a naming convention that makes the instance type easy to identify, such as including -standard or -vault dedicated in the instance name.

  5. Click Create.

Provisioning typically completes within a few minutes, but it can take up to 15 minutes.

For more information about provisioning an instance, see Creating an instance.

Generate an admin token

To access the Vault UI for initial configuration, generate an admin token.

Admin tokens are intended for initial setup and emergency access only. Revoke them as soon as you complete your setup tasks.

Generating an admin token in the UI

  1. In your Secrets Manager instance dashboard, click Create token in the Create new admin token section.
  2. Copy the generated admin token and store it securely. You'll need this token to sign in to the Vault UI.

Generating an admin token from the CLI

To generate a new Vault admin token by using the IBM Cloud CLI, run the following command.

ibmcloud secrets-manager-instance-management admin-token-create --id {instance_id}

The command returns the Vault admin token. Store it securely — you need this token to sign in to the Vault UI.

Generating an admin token with the API

curl -X POST \
  -H "Authorization: Bearer {iam_token}" \
  -H "Accept: application/json" \
  "https://{region}.secrets-manager.cloud.ibm.com/v2/instances/{id}/admintokens"

A successful request returns HTTP 201 Created. The response contains a single token field — store it securely and use it to sign in to the Vault UI. The token is valid for 1 hour.

Generating an admin token with Terraform

To generate a Vault admin token with Terraform, use the ibm_sm_admin_token resource. The token is valid for 1 hour, and is automatically refreshed when it is close to expiry.

resource "ibm_sm_admin_token" "sm_admin_token" {
  instance_id = "bfc50c2e-d66d-4f37-9ccf-9713f8325b39"
}

After the resource is created, the Vault admin token is available in the token attribute.

Open the Vault UI

Use the Vault API endpoint to open the Vault UI and sign in with the admin token.

  1. In the Secrets Manager instance dashboard, click Launch web UI to access the Vault native UI.
  2. On the Vault sign-in page, use the admin token that you created and complete your initial Vault configuration.

Revoke the admin token

After you finish the initial setup, revoke any active admin tokens to help reduce the risk of unintended access.

Revoking admin tokens in the UI

  1. In your Secrets Manager instance dashboard, click Revoke in the Revoke all admin tokens section.
  2. Confirm the revocation when prompted.

Revoking the token immediately invalidates it and helps reduce the risk of unintended access.

Revoking admin tokens from the CLI

To revoke all active Vault admin tokens by using the IBM Cloud CLI, run the following command.

ibmcloud secrets-manager-instance-management admin-tokens-delete --id {instance_id}

This operation immediately invalidates all admin tokens, requiring new tokens to be generated for future administrative access.

Revoking admin tokens with the API

curl -X DELETE \
  -H "Authorization: Bearer {iam_token}" \
  "https://{region}.secrets-manager.cloud.ibm.com/v2/instances/{id}/admintokens"

A successful revocation returns a 204 No Content status code.

Next steps

After you sign in to Vault, you can continue with the initial configuration of your instance.