Skip to main content
Use this provider when your organization already runs Vault and wants secret operations through KV v2.

​
Environment Variables

VariableRequiredNotes
SECRETS_MANAGER_TYPEYesSet to hashicorp_vault.
SECRETS_MANAGER_VAULT_ADDRESSYesVault address, for example https://vault.example.com.
SECRETS_MANAGER_VAULT_TOKENConditionally requiredUse token auth, or use AppRole instead.
SECRETS_MANAGER_VAULT_ROLE_IDConditionally requiredRequired with SECRETS_MANAGER_VAULT_SECRET_ID for AppRole auth.
SECRETS_MANAGER_VAULT_SECRET_IDConditionally requiredRequired with SECRETS_MANAGER_VAULT_ROLE_ID for AppRole auth.
SECRETS_MANAGER_VAULT_NAMESPACEOptionalVault Enterprise namespace.
SECRETS_MANAGER_VAULT_MOUNT_PATHOptionalKV v2 mount path. Defaults to secret.
Authentication behavior:
  • If SECRETS_MANAGER_VAULT_TOKEN is set, token auth is used.
  • Otherwise, ROLE_ID + SECRET_ID are required for AppRole login.

​
Create Vault Resources and Credentials

  1. Ensure a KV v2 engine exists (example mount secret):
vault secrets enable -path=secret kv-v2
  1. Create a policy for wonderful-secrets (example wonderful-secrets-policy):
path "secret/data/*" {
  capabilities = ["create", "read", "update"]
}

path "secret/metadata/*" {
  capabilities = ["delete"]
}
  1. Choose auth mode:
  • Token mode:
vault token create -policy=wonderful-secrets-policy
  • AppRole mode:
vault auth enable approle
vault write auth/approle/role/wonderful-secrets token_policies="wonderful-secrets-policy"
vault read auth/approle/role/wonderful-secrets/role-id
vault write -f auth/approle/role/wonderful-secrets/secret-id
  1. Collect values:
    • Vault address from VAULT_ADDR or your Vault endpoint.
    • Mount path (secret in the example above).
    • Token or AppRole credentials.
    • Namespace if running Vault Enterprise.

​
Map Credentials to Env Vars

Vault valueEnv var
Vault addressSECRETS_MANAGER_VAULT_ADDRESS
TokenSECRETS_MANAGER_VAULT_TOKEN
AppRole Role IDSECRETS_MANAGER_VAULT_ROLE_ID
AppRole Secret IDSECRETS_MANAGER_VAULT_SECRET_ID
NamespaceSECRETS_MANAGER_VAULT_NAMESPACE
KV v2 mount pathSECRETS_MANAGER_VAULT_MOUNT_PATH

​
Local Switch Example

# env_files/secrets.env
SECRETS_MANAGER_TYPE=hashicorp_vault
SECRETS_MANAGER_VAULT_ADDRESS=https://vault.example.com
SECRETS_MANAGER_VAULT_TOKEN=<token>
SECRETS_MANAGER_VAULT_MOUNT_PATH=secret
# Optional
# SECRETS_MANAGER_VAULT_NAMESPACE=<namespace>
Restart wonderful-secrets after changing these values.

​
What to Verify

  1. Ensure the mount path is KV v2.
  2. Run the smoke test from Secret Managers.
  3. Confirm secrets are written under the configured KV v2 mount.