Install Vault (Ubuntu)
sudo apt update
sudo apt install -y gpg wget
wget -O- https://apt.releases.hashicorp.com/gpg | \
gpg --dearmor | \
sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update
sudo apt install vault
vault versionStart Vault (dev mode)
For learning only:
vault server -devExample output:
Vault Address: http://127.0.0.1:8200
Root Token: hvs.xxxxxxxxxxxxxxxxx
-dev mode stores data in memory and is insecure by design. Never use it for production.
Configure the CLI
In a second terminal:
export VAULT_ADDR="http://127.0.0.1:8200"
export VAULT_TOKEN="hvs.xxxxxxxxxxxxx"
vault statusEnable AppRole
vault auth enable approleCreate a role for Terraform:
vault write -force auth/approle/role/terraformRead the role ID:
vault read auth/approle/role/terraform/role-idGenerate a secret ID:
vault write -f auth/approle/role/terraform/secret-idSave both values — Terraform will use them to log in.
Enable KV v2 and store a secret
vault secrets enable -path=secret kv-v2
vault kv put secret/ec2 key_name="terraform-key"
vault kv get secret/ec2Example:
====== Secret ======
key_name terraform-key
Create the matching EC2 key pair in AWS (terraform-key) before you apply Terraform, or the instance launch will fail.