HashiCorp Vault Read Write and Delete secrets - Part 3 | HashiCorp Vault tutorial series

Summary

The video script provides a comprehensive guide on managing secrets using HashiCorp Vault's command line interface. It walks through the essential operations of writing, reading, and deleting key-value pair secrets, emphasizing the importance of enabling custom paths within the secret engine for storing and retrieving data. The tutorial also touches on viewing secrets in JSON format and listing all available secrets at a particular path. It sets the stage for future discussions on enabling AWS secret engines and managing them effectively.

Takeaways

• 🔑 Installed and started the Vault server in development mode for performing operations.
• 📝 Performed basic operations using the command line interface of Vault: read, write, and delete.
• 🔒 Wrote secrets by defining key-value pairs and storing them at a specified custom path in the Vault server.
• 💡 Explained the syntax of the Vault 'put' command for writing secrets into the Vault server.
• 🛠️ Demonstrated how to enable a custom path in the secret engine for storing key-value pairs.
• 🔍 Showed how to read secrets from Vault, including the ability to output in JSON format.
• 🗑️ Described the process of deleting secrets from the Vault using the 'delete' command.
• 📋 Listed all available secrets at a particular path using the 'list' command.
• 🔄 Verified the deletion of secrets by attempting to read the deleted secret and confirming no value was found.
• 🚀 Discussed the plan for the next session, which includes further exploration of the secret engine and managing AWS secret engine.

Q & A

What was the first step taken in the script regarding Vault?

The first step taken in the script was installing and starting the Vault server in development mode.

What operations were performed using the Vault command line interface?

The operations performed using the Vault command line interface were read, write, and delete.

How is a secret written to the Vault server?

A secret is written to the Vault server by using the 'put' command followed by the path and the key-value pair representing the secret.

What is a custom path in Vault and how is it used?

A custom path in Vault is a user-defined route where secrets are stored. It is used to organize and access secrets efficiently.

What is the significance of the 'secret engine' in HashiCorp Vault?

The 'secret engine' in HashiCorp Vault is a mechanism that manages the storage and access of secrets. It requires enabling a custom path before storing secrets in it.

How can you read a secret from the Vault server?

You can read a secret from the Vault server using the 'vault kv get' command followed by the path of the secret.

Is it possible to view secrets in a JSON format in Vault?

Yes, it is possible to view secrets in a JSON format by specifying the 'format' as 'json' in the 'vault kv get' command.

How can you list all available secrets at a particular path?

You can list all available secrets at a particular path using the 'vault secret list' command followed by the path.

What command is used to delete a secret from Vault?

The 'vault kv delete' command is used to delete a secret from Vault, followed by the path of the secret.

How can you verify the deletion of a secret?

You can verify the deletion of a secret by attempting to read the secret using the 'vault kv get' command. If the secret has been deleted successfully, the command will return a 'no value found' message.

What will be discussed in the next session of the script?

In the next session, the script will discuss more about the secret engine, how to enable and disable the key-value pair secret engine, and additional commands to manage the secret engines.

Outlines

00:00

🔧 Introduction to Vault Server Operations

This paragraph introduces the setup and basic operations of the Vault server. It explains the process of installing and starting the Vault server in development mode. The main focus is on performing read, write, and delete operations using the command line interface of Vault. The paragraph details the syntax and usage of commands for these operations, including the need to specify the type of secret being stored and the path where it will be stored. It also touches on the concept of a secret engine in the HashiCorp ecosystem and the necessity of enabling custom paths within the secret engine before storing secrets.

05:01

📋 Listing and Deleting Secrets in Vault

This paragraph delves into the commands for listing all available secrets at a specific path and deleting secrets from the Vault server. It starts by explaining how to list the parts defined inside the secret engine, including custom paths and default ones created by the HashiCorp server. The paragraph then describes the command for deleting a previously created secret, emphasizing the success message received upon deletion. To confirm the deletion, it instructs how to use the get command to read the same secret, which should now result in a 'no value found' message, indicating successful deletion.

Keywords

💡Vault

Vault is a tool for securely storing and managing sensitive information, such as tokens, passwords, and other credentials. In the context of the video, it is the primary tool being used for secret management. The script discusses installing and operating the Vault server, as well as performing operations like read, write, and delete on secrets within the Vault.

💡Command Line Interface (CLI)

The Command Line Interface, often abbreviated as CLI, is a way of interacting with a computer or application where the user issues commands in the form of lines of text. In the video, the CLI is used to interact with the Vault server, allowing the user to perform operations like reading, writing, and deleting secrets.

💡Secrets

In the context of the video, secrets refer to sensitive data such as API keys, passwords, or other confidential information that needs to be securely stored and managed. The video demonstrates how to write (create), read (retrieve), and delete these secrets within the Vault system.

💡Key-Value Pair

A key-value pair is a fundamental data structure used in computing where each item is stored as a pair of a unique key and its associated value. In the video, this concept is used to describe how secrets are stored in Vault, with each secret having a unique identifier (key) and its corresponding data (value).

💡Path

In the context of the video, a path refers to the location within the Vault server where a secret is stored. Paths are used to organize and access secrets in a structured manner, similar to how files are organized in a file system.

💡Secret Engine

A Secret Engine in the Vault ecosystem is a component that manages a specific type of secret, such as key-value secrets or AWS credentials. The video discusses enabling custom paths within a secret engine to store and manage different kinds of secrets.

💡Enable

In the context of the video, 'enable' refers to the action of activating a feature or path within the Vault server. This is a necessary step before storing secrets in a new custom path, allowing the Vault to recognize and manage secrets at that location.

💡Read Operation

A read operation in the context of the video is the process of retrieving or accessing a stored secret from the Vault server. This is one of the core operations performed on secrets, allowing users to view the values associated with their keys.

💡Delete Operation

A delete operation is the process of removing a secret from the Vault server. This is an essential part of secret management, ensuring that sensitive data can be securely removed when it is no longer needed.

💡List Command

The list command in the video is used to display all available secrets or paths within the Vault server. This helps users understand the current organization and content of their Vault, allowing them to manage secrets more effectively.

💡JSON Format

JSON, or JavaScript Object Notation, is a lightweight data interchange format that is easy for humans to read and write, and for machines to parse and generate. In the video, the JSON format is used as an option for outputting the data from the Vault server in a structured and machine-readable way.

Highlights

Installation and starting of Vault server in development mode.

Performing operations using the command line interface of Vault.

Executing read, write, and delete operations on secrets.

Writing secrets into the Vault server using key-value pairs.

Defining a custom path for storing secrets in the Vault.

Using the 'put' command to write secrets into the Vault.

Enabling a custom path within the secret engine for storing key-value pairs.

Successfully enabling the path and storing the first secret.

Reading secrets from the Vault using the 'get' command.

Fetching secrets in JSON format using Vault commands.

Listing all available secrets at a particular path using Vault.

Deleting secrets from the Vault with the 'delete' command.

Verifying the deletion of secrets by attempting to read the deleted secret.

An overview of managing secrets through the Vault server's command line interface.

Introduction to the concept of secret engines in HashiCorp Vault.

Explanation of key-value pair secrets and their usage in Vault.

Upcoming session on enabling and managing AWS secret engine and key-value pair secret engine.

Transcripts

all right so till now what we have done

so far we have installed the Vault

server and as well as we have started

the Vault server into the development

mode so the next thing which we are

going to do we are just going to perform

some operation using the command line

interface of Vault and the operation

which we are going to perform is the

read write and delete so using this

operation we are just going to insert or

we are just going to write the secret we

are just going to fetch or to read the

secret as well as when we are done with

all this we are just going to delete the

secret which we have written previously

so here on to the screen you can see I

have written some example command for

read write and delete but I'm just gonna

explain each command in more detail

let's start with the First Command that

is the right command and here you will

see the command start with the keyword

world so this is the first thing which

you need to write over here whenever you

are using the command line interface of

your wall the second thing is you need

to Define like what kind of a secret

you're going to store so here we are

just storing the key and value so key K

and V is the abbreviation for a key and

value so that's why you need to mention

what kind of a secret you are storing so

that means you are storing key value

pair

second we are just going to write so

that's why we need to mention put over

here

so that you can ah give the instruction

to our wall that we are just going to

write this secret into our vault server

second you need to define the path where

you are going to store this secret so

this is the path this is a custom path

you can write any path of your choice so

here I have written a path my slash path

so this is the path where our secrets

will be stored all right the next thing

is the actual value and since we are

using the key value pair so we need to

define a key first and then its value so

here you will notice this is the key and

this is the value so this is the key ah

for our secret and this is the value for

our secret so this is the typical syntax

of our Hashi core write or a put

operation there is also one more

important concept of a secret engine in

the hashicorp world so if you notice

over here in this right command we have

mentioned the path over here

this is the path so whenever you specify

a new custom path so this is my custom

path over here so if you are working

with the hashicorp world and if you need

a new custom part then you need to

enable this custom path into the secret

engine I'm just gonna show the command

to enable that so here if you notice

over here so this is the command for

enabling the path for inside your secret

engine so this is the command how it

starts with the Vault then you need to

specify secret then you need to specify

the keyword enable and then you need to

specify the path so this is the thing

which you need to mention inside your

hashicop server so that it can enable

that particular path inside your secret

engine and apart from that you need to

mention what it is so it is a key value

pair kind of for Secrets which you are

planning to store so this is the

important command which you need to run

before you start writing or inserting

your secret let's switch over to the

terminal and is my terminal and the

first thing which I'm just gonna start

I'm just gonna enable the path in my

secret engine so this is the command

which I'm just gonna run so that will

enable the path my

so here you can see this is the

successful message which I got after

that I'm just gonna insert my first

secret key value pair

and here you can see uh success message

and the data written into the path my

slash path now after writing like how to

read the secret from our Hashi curve

fault so here you can see on to the

screen this is the command vault key

value get and the path name so this is

the command which I'm gonna use so I'm

just talking about this command

okay so I'm just gonna get back to my

terminal once again and I'm just gonna

make some space and hit enter and here

you can see I'm just trying to read the

secret stored at my slash path there is

also one more cool feature of our

hashicorp world you can read the secret

in the Json format also and the command

for that is I'm just gonna clear the

screen over here and paste the command

over here so here you can see this is

the output in the Json format so what

you need to do is vault key value get

and you need to specify the format Json

after that the path where your key value

or the secrets has been stored so this

is how you can generate the output in

the Json format as well all right so now

we have seen the right operation we have

seen the read operation and also we have

seen how to enable the path in the

secret engine so the next command which

we are gonna see is the delete command

how we are going to delete the secret

from the world but before that there is

also one more import concept or one more

important command to list all the

available Secrets at particular path

so I'll just go back to my terminal and

I'm just gonna run command Vault secret

list

so here you can see these are the parts

which are defined inside my secret

engine so here you will find my path

also so this is the my custom path which

I have created apart from that these are

the default ones so this is secret this

is this this is identity and this is

Cubby Hole so these are the four the

other four which by default created by

hashicop server and apart from that if

you run this command Vault secret list

then you will find all the available

path which are defined inside your Vault

server so this is how you can run this

command to view or to list all the

secret path available into your

hashicorp server all right let's run the

delete command so that we can delete the

secret which we have created and the

command for that is vault key value that

is KB delete and the path that is my

slash path and it will delete the secret

which we have created previously simply

hit enter and as you can see this is the

success message and the data has been

deleted from my path and just to verify

let's run the get command once again to

read the same secret which we have just

deleted so just simply hit enter onto

your terminal and here you can see no

value found at my slash path that means

we have successfully deleted our key

value secret which we have stored

previously all right so now you know

like how you can read write and delete

the secrets from your hashikov Vault

server in the next session we are going

to talk more about the secret engine and

we will be taking a look how to enable

the AWS secret engine how to enable and

disable the key value pair secret engine

and some more commands to manage the

secret engines