> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Transit Secrets Engine

> This tutorial covers enabling and configuring the Vault Transit Secrets Engine for managing encryption keys and performing cryptographic operations.

Welcome to this tutorial on the Vault Transit Secrets Engine. In this guide, you'll learn how to enable and configure the Transit engine, manage encryption keys, and perform encrypt, decrypt, and rewrap operations.

## Table of Contents

* [Overview](#overview)
* [Verify Enabled Secrets Engines](#verify-enabled-secrets-engines)
* [Enable the Transit Engine](#enable-the-transit-engine)
* [Create and Inspect an Encryption Key](#create-and-inspect-an-encryption-key)
* [Rotate an Encryption Key](#rotate-an-encryption-key)
* [Encrypt Data](#encrypt-data)
* [Rewrap Data After Rotation](#rewrap-data-after-rotation)
* [Decrypt Ciphertexts](#decrypt-ciphertexts)
* [Enforce Minimum Decryption Version](#enforce-minimum-decryption-version)
* [Conclusion](#conclusion)

## Overview

The Transit Secrets Engine provides cryptographic functions as a service. It allows you to offload encryption, decryption, key management, and more to Vault without storing raw data.

Learn more in the official docs: [Transit Secrets Engine](https://www.vaultproject.io/docs/secrets/transit).

## Verify Enabled Secrets Engines

First, check which secrets engines are active on your Vault dev server:

```bash theme={null}
vault secrets list
```

Expected output in dev mode:

| Path       | Type      | Description                              |
| ---------- | --------- | ---------------------------------------- |
| cubbyhole/ | cubbyhole | per-token private secret storage         |
| identity/  | identity  | identity store                           |
| secret/    | kv (v2)   | key/value secret storage                 |
| sys/       | system    | system endpoints for control & debugging |

<Callout icon="lightbulb" color="#1CB2FE">
  In Vault dev mode, the `cubbyhole/`, `identity/`, `secret/` (KV v2), and `sys/` engines are enabled by default.
</Callout>

## Enable the Transit Engine

Enable the Transit engine at the default path `transit/`:

```bash theme={null}
vault secrets enable transit
```

Verify it was added:

```bash theme={null}
vault secrets list
```

| Path     | Type    | Description |
| -------- | ------- | ----------- |
| transit/ | transit | n/a         |

You can also add a description when enabling:

```bash theme={null}
vault secrets disable transit
vault secrets enable -description="My transit engine" transit
vault secrets list
```

## Create and Inspect an Encryption Key

Create a new key named `training`:

```bash theme={null}
vault write -f transit/keys/training
```

Then read its configuration:

```bash theme={null}
vault read transit/keys/training
```

Key configuration highlights:

| Field                | Value        |
| -------------------- | ------------ |
| name                 | training     |
| type                 | aes256-gcm96 |
| latest\_version      | 1            |
| supports\_encryption | true         |
| supports\_decryption | true         |

## Rotate an Encryption Key

Rotate `training` to generate a new version:

```bash theme={null}
vault write -f transit/keys/training/rotate
```

Verify the version bump:

```bash theme={null}
vault read transit/keys/training | grep latest_version
# latest_version: 2
```

## Encrypt Data

1. Base64-encode your plaintext:
   ```bash theme={null}
   BASE64=$(base64 <<< "Getting Started with HashiCorp Vault")
   echo $BASE64
   ```
2. Encrypt the encoded string:
   ```bash theme={null}
   vault write transit/encrypt/training plaintext=$BASE64
   ```

Sample response:

```text theme={null}
Key         Value
---         -----
ciphertext  vault:v2:…  
key_version 2  
```

Store the `ciphertext` for later use.

## Rewrap Data After Rotation

After rotating to version 3:

```bash theme={null}
vault write -f transit/keys/training/rotate
```

Rewrap the version 2 ciphertext to version 3:

```bash theme={null}
vault write transit/rewrap/training \
  ciphertext="vault:v2:…"
```

Response:

```text theme={null}
Key         Value
---         -----
ciphertext  vault:v3:…  
key_version 3  
```

## Decrypt Ciphertexts

Decrypt version 2:

```bash theme={null}
vault write transit/decrypt/training ciphertext="vault:v2:…"
```

Decrypt version 3:

```bash theme={null}
vault write transit/decrypt/training ciphertext="vault:v3:…"
```

Both return the same Base64 plaintext.

## Enforce Minimum Decryption Version

To block decryption of older ciphertext, set `min_decryption_version=3`:

```bash theme={null}
vault write transit/keys/training/config min_decryption_version=3
```

Verify:

```bash theme={null}
vault read transit/keys/training
# min_decryption_version: 3
```

Attempting to decrypt version 2 now fails:

```bash theme={null}
vault write transit/decrypt/training ciphertext="vault:v2:…"
```

<Callout icon="triangle-alert" color="#FF6B6B">
  Any ciphertext with a version lower than the `min_decryption_version` will be rejected.
</Callout>

Decryption of version 3 still succeeds:

```bash theme={null}
vault write transit/decrypt/training ciphertext="vault:v3:…"
```

## Conclusion

In this lesson, you have:

* Enabled and configured the Transit Secrets Engine
* Created, rotated, and inspected encryption keys
* Encrypted, decrypted, and rewrapped data
* Enforced minimum decryption version policies

For more information, visit the [Vault Transit Secrets Engine documentation](https://www.vaultproject.io/docs/secrets/transit).

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/hashicorp-certified-vault-operations-professional-2022/module/b59936f2-3ed0-4ec2-b1fd-971dcce5c2ca/lesson/73cc37b9-4677-4263-ab67-988cec966042" />

  <Card title="Practice Lab" icon="installation" cta="Learn more" href="https://learn.kodekloud.com/user/courses/hashicorp-certified-vault-operations-professional-2022/module/b59936f2-3ed0-4ec2-b1fd-971dcce5c2ca/lesson/dc0cb54c-c853-4bdf-819c-83a0a0094bab" />
</CardGroup>