In this tutorial, you’ll learn how to configure and use Vault’s AppRole authentication method to grant machine clients read access to a KV secrets engine. By the end, you’ll create a policy, define an AppRole, and retrieve a client token using Role ID and Secret ID.Documentation Index
Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
Use this file to discover all available pages before exploring further.
Prerequisites
- A running Vault server
VAULT_ADDRenvironment variable set (e.g.,export VAULT_ADDR=http://127.0.0.1:8200)- Vault CLI installed and authenticated as an administrator
1. Verify Enabled Auth Methods
By default, Vault includes the Token auth method. Let’s confirm:| Auth Method | Path | Description |
|---|---|---|
| token | token/ | Default client token login |
| approle | approle/ | Machine-based, non-human login |
2. Enable AppRole Auth Method
Enable AppRole at the pathapprole/:
3. Define a Read-Only KV Policy
Create a policy file namedkv-policy.hcl:
4. Create and Configure the AppRole
4.1 Create the AppRole
Associate thekv-policy with a new AppRole called automation:
4.2 List and Inspect Roles
List all AppRole roles:automation role’s settings:
4.3 (Optional) Set a Default Token TTL
Assign a 24-hour default token TTL to theautomation role:
5. Retrieve the Role ID
The Role ID is a stable, unique identifier—think of it as a username. Fetch it with:6. Generate a Secret ID
The Secret ID is equivalent to a password. To get a one-time Secret ID, run:Treat both Role ID and Secret ID as sensitive credentials. Avoid exposing them in logs, version control, or shared terminals.
7. Authenticate with AppRole
Now request a Vault token by supplying your Role ID and Secret ID:kv/data/*.
AppRole is ideal for automation and CI/CD pipelines. You can also authenticate via the HTTP API:
POST
POST
/v1/auth/approle/login with JSON body:You have successfully configured Vault’s AppRole auth method. For more details, see the Vault AppRole Authentication Guide.