> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Demo Cubbyhole Secrets Engine > Learn to use Vault’s Cubbyhole Secrets Engine for data isolation and Response Wrapping for secure, one-time secret delivery. In this tutorial, you’ll learn how to leverage Vault’s **Cubbyhole Secrets Engine** for per-token data isolation and use **Response Wrapping** for secure, one-time delivery of secrets. We’ll cover: * Writing and reading token-specific cubbyhole data * Proving isolation between tokens * Populating and protecting a KV secret * Generating and unwrapping a wrapped secret both via CLI and UI ## Prerequisites * Vault 1.10.0 Enterprise installed locally (initialized & unsealed) * Environment variable: `VAULT_ADDR=http://127.0.0.1:8200` * Familiarity with basic Vault concepts ([Vault Overview][vault-overview]) ## 1. Verify Vault Status ```bash theme={null} vault status ``` Expected output: ```text theme={null} Key Value --- ----- Recovery Seal Type shamir Initialized true Sealed false Version 1.10.0+ent Storage Type raft HA Enabled true ``` ## 2. Authenticate as Root ```bash theme={null} vault login ``` > Success! You are now authenticated as the root user. ## 3. Create an Unprivileged Token Create a token with only the `default` policy: ```bash theme={null} vault token create -policy=default ``` Output: ```text theme={null} Key Value --- ----- token hv.s.XXXXXXXXXXXXXX token_accessor NuBg8k455X2yQERKgRxV3134 token_policies ["default"] ``` Save the token value and log in with it: ```bash theme={null} vault login hv.s.XXXXXXXXXXXXXX ``` > Success! You are now authenticated with limited permissions. ## 4. Working with Cubbyhole Every token receives a private cubbyhole path. Only the token owner can write/read its own cubbyhole. ### 4.1 Write to Cubbyhole ```bash theme={null} vault write cubbyhole/training certification=hcvop ``` ### 4.2 Read from Cubbyhole ```bash theme={null} vault read cubbyhole/training ``` ```text theme={null} Key Value --- ----- certification hcvop ``` ### 4.3 Proving Token Isolation Cubbyhole paths are isolated per token. No token can access another token’s cubbyhole. 1. **Switch back to root** ```bash theme={null} vault login ``` 2. **Attempt to read the unprivileged token’s cubbyhole** ```bash theme={null} vault read cubbyhole/training ``` Output: `No value found at cubbyhole/training` 3. **Confirm unprivileged token can still read its own data** ```bash theme={null} vault login hv.s.XXXXXXXXXXXXXX vault read cubbyhole/training ``` ## 5. KV Secrets Engine & Access Control Next, we’ll show how an unprivileged token is denied access to KV secrets written by root. | Token Type | Accessible Path | Permissions | | ------------------ | --------------- | -------------------- | | Root Token | secret/data/\* | read, write, delete | | Unprivileged Token | cubbyhole/\* | read, write own only | ### 5.1 As Root: Write a KV Secret ```bash theme={null} vault kv put secret/training goal=hcvop ``` ### 5.2 As Root: Read the KV Secret ```bash theme={null} vault kv get secret/training ``` ```text theme={null} ====== Secret Path ====== secret/data/training === Data === Key Value --- ----- goal hcvop ``` ### 5.3 Denied Access for Unprivileged Token ```bash theme={null} vault login hv.s.XXXXXXXXXXXXXX vault kv get secret/training ``` ```text theme={null} Error making API request. Code: 403. Errors: * permission denied on path "secret/data/training" ``` ## 6. Response Wrapping Response wrapping provides a one-time-use, time-limited wrapping token for secure secret transfer. ### 6.1 Generate a Wrapping Token As root, request a 60-minute wrapped response: ```bash theme={null} vault kv get -wrap-ttl=60m secret/training ``` ```text theme={null} Key Value --- ----- wrapping_token hvs.CAESIHHiPSBDnG75y4hN... wrapping_token_ttl 1h wrapping_token_creation_path secret/data/training ``` ### 6.2 Inspect the Wrapping Token ```bash theme={null} vault token lookup hvs.CAESIHHiPSBDnG75y4hN... ``` ```text theme={null} Key Value --- ----- path secret/data/training policies [response-wrapping] ttl 59m30s num_uses 1 ``` ### 6.3 Unwrap as Unprivileged User 1. Log in with the limited token: ```bash theme={null} vault login hv.s.XXXXXXXXXXXXXX ``` 2. Unwrap the secret: ```bash theme={null} vault unwrap hvs.CAESIHHiPSBDnG75y4hN... ``` ```text theme={null} Key Value --- ----- data map[goal:hcvop] metadata map[created_time:... version:1] ``` ### 6.4 TTL & One-Time Use Demonstration ```bash theme={null} vault kv get -wrap-ttl=5s secret/training # wrapping_token: hvs.CAESI…XYZ # Wait >5 seconds vault unwrap hvs.CAESI…XYZ # Error: wrapping token is not valid or does not exist ``` Or with 5-minute TTL: ```bash theme={null} vault kv get -wrap-ttl=5m secret/training # wrapping_token: hvs.CAESI…ABC vault unwrap hvs.CAESI…ABC # succeeds vault unwrap hvs.CAESI…ABC # fails immediately ``` ## 7. UI Demonstration In the Vault UI, a privileged user can: 1. Navigate to **Secrets → KV** 2. Select **training** and choose **Wrap** 3. Copy the wrapping token and share via secure channels An unprivileged user then goes to **Tools → Unwrap Secret**, pastes the token, and retrieves the secret. ![The image shows a web interface for HashiCorp Vault, displaying a secret with a key-value pair under the "training" section. A notification at the bottom indicates a secret was successfully wrapped.](https://kodekloud.com/kk-media/image/upload/v1752878420/notes-assets/images/HashiCorp-Certified-Vault-Operations-Professional-2022-Demo-Cubbyhole-Secrets-Engine/hashicorp-vault-web-interface-secret-training.jpg) *** ## Summary * Stored token-specific data in **Cubbyhole** * Verified strict isolation between tokens * Secured KV secrets and demonstrated access denial * Generated, inspected, and unwrapped **response-wrapping** tokens * Showed one-time-use and TTL behaviors via CLI & UI By following this guide, you can securely share secrets without exposing them directly over the network. *** ## References * [Vault Overview][vault-overview] * [Cubbyhole Secrets Engine][cubbyhole-docs] * [Response Wrapping Guide][wrapping-docs] [vault-overview]: https://www.vaultproject.io/docs/what-is-vault [cubbyhole-docs]: https://www.vaultproject.io/docs/secrets/cubbyhole [wrapping-docs]: https://www.vaultproject.io/docs/concepts/response-wrapping