IaC

Vault Playground

HashiCorp Vault is a secrets management platform for securely storing, accessing, and auditing sensitive data like API keys and certificates..

Get access to the Vault playground with one click

Welcome to the HashiCorp Vault Playground!

HashiCorp Vault 1.18 — the industry-standard secrets management platform. Store, access, and audit sensitive data with dynamic secrets, encryption, and fine-grained policies.

Tip: Vault dev server starts automatically. VAULT_ADDR and VAULT_TOKEN=root are already set in your environment. Run vault status to confirm it’s ready.

What’s Pre-installed

Vault 1.18 — dev server starts in background automatically
Environment: VAULT_ADDR=http://127.0.0.1:8200, VAULT_TOKEN=root
Shell: bash with curl, wget, jq

Quick Start

vault status
vault secrets list
vault kv list secret/

Common Workflows

# KV secrets (v2)
vault kv put secret/myapp db_url="postgres://..." api_key="abc123"
vault kv get secret/myapp
vault kv get -field=api_key secret/myapp
vault kv delete secret/myapp

# List all secrets
vault kv list secret/

# Enable a new secrets engine
vault secrets enable -path=kv2 kv-v2
vault kv put kv2/config timeout=30

Advanced Tips

# Dynamic AWS credentials (requires AWS provider config)
vault secrets enable aws
vault write aws/config/root access_key=... secret_key=...
vault write aws/roles/my-role credential_type=iam_user policy_arns=...
vault read aws/creds/my-role   # generates temp credentials

# Policies
cat > policy.hcl <<'EOF'
path "secret/data/myapp/*" { capabilities = ["read"] }
EOF
vault policy write myapp-read policy.hcl
vault token create -policy=myapp-read

# Transit (encryption as a service)
vault secrets enable transit
vault write transit/keys/mykey type=aes256-gcm96
vault write transit/encrypt/mykey plaintext=$(base64 <<< "my secret")

Session Notes

Session lasts 1 hour.
Dev server is NOT for production — data resets on restart. It’s pre-unsealed for learning.