Skip to main content



This cheat sheet provides a quick reference for some common HashiCorp Vault commands and concepts. HashiCorp Vault is a popular open-source tool for managing secrets and protecting sensitive data.


To use HashiCorp Vault, you need to install and configure it on your system or use the cloud-managed version offered by HashiCorp. Refer to the official Vault documentation for installation instructions.

Vault Concepts


Secrets are sensitive pieces of information, such as API keys, passwords, and certificates, stored and managed by Vault.

  • Store a secret in Vault:

    vault kv put secret/myapp/apikey=secret-value
  • Retrieve a secret from Vault:

    vault kv get secret/myapp/apikey

Authentication Methods

Vault supports various authentication methods for authenticating users or applications, such as tokens, username/password, and LDAP.

  • Enable an authentication method:
    vault auth enable method_name


Policies define the permissions and access controls for different paths and operations within Vault.

  • Create a policy:
    vault policy write my-policy policy.hcl

Token Management

Tokens are used for authentication and access control in Vault.

  • Create a token with a policy attached:

    vault token create -policy=my-policy
  • Authenticate with a token:

    vault login token_value

Dynamic Secrets

Vault can generate dynamic secrets for databases, cloud providers, and more.

  • Enable a dynamic secrets engine:

    vault secrets enable -path=dynamic-secret-path database
  • Configure and generate dynamic secrets as needed.

Key-Value (KV) Secrets Engine

The KV secrets engine allows you to store and manage arbitrary secrets as key-value pairs.

  • Enable the KV secrets engine:

    vault secrets enable -path=secret kv
  • Store and retrieve secrets under the specified path.

Transit Secrets Engine

The Transit secrets engine provides data encryption and decryption capabilities.

  • Enable the Transit secrets engine:

    vault secrets enable -path=transit transit
  • Configure and use the Transit secrets engine to encrypt and decrypt data.

High Availability (HA)

Vault can be configured for high availability to ensure availability and reliability.

  • Set up a Vault HA cluster with a highly available storage backend.

Vault Command-Line

  • Initialize a new Vault server (in development mode):

    vault server -dev
  • Unseal a sealed Vault server (in production mode):

    vault operator unseal
  • Seal a Vault server to prevent access:

    vault operator seal
  • List enabled secrets engines and authentication methods:

    vault secrets list
    vault auth list
  • Display the status and health of the Vault server:

    vault status


This cheat sheet covers some common HashiCorp Vault commands and concepts. Vault is a powerful tool for securing and managing secrets and sensitive data; refer to the official Vault documentation for more in-depth information and advanced usage.