Hashicorp Vault

HashiCorp Vault is a comprehensive secrets management and data protection platform designed to secure, store, and tightly control access to sensitive data including tokens, passwords, certificates, encryption keys, API keys, and other secrets in modern computing environments. Vault provides a unified interface to any secret while providing tight access control through detailed audit logs and policy-based authorization.

Category	Secrets management
Direction	Query source
Sign-in	Vault Token, AWS Auth
Query languages	SQLite
Website	hashicorp.com

Before you start

Huntbase can sign in to Hashicorp Vault with any of these methods: Vault Token, AWS Auth. Pick one, create the credential in Hashicorp Vault, then keep it to hand for the Connect step.

Vault Token

Authenticate to Vault using an API token (auth_type token).

1. Create a Vault policy that grants only the read and list capabilities on the paths you want to query.
2. Create a token with that policy by running vault token create -policy=<policy-name>.
3. Copy the value in the token field of the output.

Permissions:

• A policy with only read and list capabilities.

Watch out for

• Non-root tokens expire when their TTL runs out unless they're renewed. Replace the token before it expires, or ask your Vault admin for a periodic token (-period).
• If a Vault token is entered, it's used even when AWS Auth is selected.

For the vendor's own instructions, see Vault token create documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Hashicorp Vault

1. Go to Connections and click New connection, or click New connection on the Hashicorp Vault product page.
2. On Product, pick Hashicorp Vault and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your Hashicorp Vault lives:

Field	Required	Notes
Vault Address	No	The URL of your Vault server, such as https://vault.mycorp.com/.
Auth Type	No	Use token for the Vault Token method, or aws for AWS Auth. One of token, aws. Defaults to token.
AWS Vault Role	No	The Vault role to authenticate as, for AWS Auth.
AWS Auth Backend Path	No	The mount path of the AWS auth method in Vault, for AWS Auth.

Credentials

Choose a Method, enter a Credential label (for example Production), then fill in the fields for that method.

Vault Token

Field	Required	Notes
Vault Token	Yes	Secret — not shown again after you save it.

AWS Auth

No fields — choose this method to connect without credentials.

Query it

Once connected, Hashicorp Vault can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL across this source and every other connected source.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog