Vault Environment Tool
A small utility to export data from vault as environment variables or download as files.
Installation
You can download one of the pre-compiled binaries from the list below.
- Mac (Intel)
- Mac (Apple Silicon)
- Linux (ARM)
- Linux (32-bit)
- Linux (64-bit)
- Windows (32-bit)
- Windows (64-bit)
All versions are available via the package registry.
Configuration
To avoid providing the server address and token via a flag every time, you can define environment variables named VAULT_ADDR and VAULT_TOKEN instead.
If you prefer you can also set these values in a .env file like this:
VAULT_ADDR=http://localhost:8200
VAULT_TOKEN=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXXUsage
> vaultenv helpSee the generated documentation for more information about the various commands.
Creating a read only token for vault
The following example sets up a policy with read-only access to secrets/env, and an 'lts' role that has a token ttl of 10 years.
> vault policy-write secret-ro acl.hcl
> vault write /auth/token/roles/lts allowed_policies="secret-ro" period="87600h"
> vault token-create -role lts
Key Value
--- -----
token 15958ab2-0e1a-3264-ff47-6963ed45aa68
token_accessor 815f1db5-2fd0-2471-e233-faf6fc9718c9
token_duration 87600h0m0s
token_renewable true
token_policies [default secret-ro]
> export VAULT_TOKEN=15958ab2-0e1a-3264-ff47-6963ed45aa68
> vault read auth/token/lookup-self
Key Value
--- -----
accessor 815f1db5-2fd0-2471-e233-faf6fc9718c9
creation_time 1478099538
creation_ttl 315360000
display_name token
explicit_max_ttl 0
id 15958ab2-0e1a-3264-ff47-6963ed45aa68
meta <nil>
num_uses 0
orphan false
path auth/token/create/lts
policies [default secret-ro]
renewable true
role lts
ttl 315359676