alexey-gusarov / secretmanagement.hashicorp.vault.kv

A PowerShell SecretManagement extension for Hashicorp Vault Key Value Engine

SecretManagement.Hashicorp.Vault.KV

A PowerShell SecretManagement extension for Hashicorp Vault Key Value (KV) Engine. This supports version 1, version2, and cubbyhole (similar to v1). It does not currently support all of the version 2 features like versioned secrets.

NOTE: This project is not a maintained by Hashicorp.
I work on this in my free time because I use Vault.
If Hashicorp would like to adopt this module please reach out.

QuickStart

When registering a vault you need to provide at least these options:

Register-SecretVault -ModuleName SecretManagement.Hashicorp.Vault.KV -Name PowerShellTest -VaultParameters @{ VaultServer = 'http://vault.domain.local:8200'; VaultAuthType = 'Token'}

The vault name should match exactly as Hashicorp vault is case sensitive. If no VaultParameters are provided the functions will prompt you on the first execution in your session. Additionally you may provide which version of KV you are using when registering. It defaults to version 2 of KV.

$VaultParameters = @{ VaultServer = 'https://vault-cluster.domain.local'
   VaultToken=$(Read-Host -AsSecureString | ConvertFrom-SecureString)
   KVVersion = 'v1'}

If you stored your secrets in a flat structure (i.e. no slashes in your path). You may want to return all secrets as a PSCredential. You can do this by providing the following:

$VaultParameters @{ ...
    OutputType = 'PSCredential'
}

The Default is to return it as a Hashtable.

You may provide either a single text string or a hashtable to the -Secret parameter.

KV Version 2 distinctions

• Get-Secret only retrieves the newest secret
• Get-SecretInfo retrieves the Hashicorp Metadata.
• Set-Secret Adds/Updates without CheckAndSet. Althought it can be passed with -Metadata @{cas=<versionNumber>}
• Remove-Secret Completely Removes the secret and all versions