Guillaume BOURGEOIS
a567558341
Vault KV v2 + sys API, 7 commands: read/write/delete/list secrets, list mounts, lookup token. Vault-token auth, stdlib-only. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
91 lines
2.9 KiB
YAML
91 lines
2.9 KiB
YAML
id: vault
|
|
name: HashiCorp Vault
|
|
version: 1.0.0
|
|
description: "HashiCorp Vault (KV v2 + sys API) — secrets management for playbooks: read, write, delete and list secrets, list mounts, and look up the current token. Vault-token authentication; stdlib-only, no extra Python dependencies."
|
|
changelog: "1.0.0 — Initial release: read/write/delete/list secrets, list mounts, lookup token."
|
|
category: cloud
|
|
|
|
# Per-instance configuration. The token is sent as the 'X-Vault-Token' header.
|
|
# kv_mount is the KV v2 mount point used by the secret commands.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "Vault URL (e.g. https://vault.example.com:8200)"
|
|
token:
|
|
type: string
|
|
description: "Vault token"
|
|
x-soar-sensitive: true
|
|
kv_mount:
|
|
type: string
|
|
description: "KV v2 mount point (default 'secret')"
|
|
default: "secret"
|
|
insecure:
|
|
type: boolean
|
|
description: "Trust any TLS certificate (not secure)"
|
|
default: false
|
|
required:
|
|
- base_url
|
|
- token
|
|
|
|
commands:
|
|
- id: read_secret
|
|
name: vault-read-secret
|
|
description: "Read a secret from the KV v2 store."
|
|
inputs_schema:
|
|
properties:
|
|
path: { type: string, description: "Secret path within the KV mount (e.g. app/db)" }
|
|
required: [path]
|
|
outputs_schema: { properties: {} }
|
|
- id: write_secret
|
|
name: vault-write-secret
|
|
description: "Write (create/update) a secret in the KV v2 store."
|
|
inputs_schema:
|
|
properties:
|
|
path: { type: string, description: "Secret path" }
|
|
data_json: { type: string, description: "Secret key/values as a JSON object" }
|
|
required: [path, data_json]
|
|
outputs_schema: { properties: {} }
|
|
- id: delete_secret
|
|
name: vault-delete-secret
|
|
description: "Delete a secret (all versions/metadata) from the KV v2 store."
|
|
inputs_schema:
|
|
properties:
|
|
path: { type: string, description: "Secret path" }
|
|
required: [path]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_secrets
|
|
name: vault-list-secrets
|
|
description: "List secret keys under a path."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
path: { type: string, description: "Path to list (empty for the mount root)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: list_mounts
|
|
name: vault-list-mounts
|
|
description: "List secret engine mounts."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: lookup_token
|
|
name: vault-lookup-token
|
|
description: "Look up the current token's metadata and policies."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: vault-test-connection
|
|
description: "Verify connectivity and the token (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|