Enable and Configure Secrets Engines

Secrets Engines are the heart of HashiCorp Vault, providing dynamic secrets, encryption, identity management, and more. In this guide, we’ll explore how to enable, configure, and manage Vault’s Secrets Engines—both generic and cloud-integrated—using the Vault CLI, API, and UI.

• What are Vault Secrets Engines?
• Generic vs. Cloud-Integrated Engines
• Enabling Engines with CLI
• Enabling Engines via UI
• Next Steps

What Are Secrets Engines?

Vault Secrets Engines enable integration with external platforms and back-end systems by generating dynamic secrets, certificates, encryption, and identity data. While Vault supports a wide range of cloud providers and services, this tutorial focuses on the core generic engines tested in the HashiCorp Certified Vault Operations Professional exam.

Generic Secrets Engines

Vault’s generic Secrets Engines do not require deep expertise in external platforms. These are commonly used across environments and covered in Vault certification:

Enabling Secrets Engines

Engines can be enabled at a custom mount path using the Vault CLI, API, or UI. The UI offers a simple way to enable common engines, but some advanced configurations require CLI or API.

Enable with Vault CLI

The vault secrets command suite manages engine lifecycle:

• enable: Mount a new engine
• disable: Unmount an engine
• list: View enabled engines
• move: Rename or relocate a mount path
• tune: Adjust engine settings (TTLs, descriptions)

# Enable AWS Secrets Engine at default path
vault secrets enable aws

# Disable the AWS Secrets Engine
vault secrets disable aws

# List all enabled Secrets Engines
vault secrets list

# Move a Secrets Engine to a new mount path
vault secrets move new-path/ old-path/

# Tune PKI engine default lease TTL to 72 hours
vault secrets tune -default-lease-ttl=72h pki/

# Enable KV v2 at custom path with description
vault secrets enable \
  --path="cloud-kv" \
  --description="My Secrets Engine" \
  kv-v2

# View detailed mount information
vault secrets list --detailed

Sample Output

Path             Type          Accessor                Description
----             ----          ---------               -----------
aws/             aws           aws_dafa7adc            n/a
azure/           aws           aws_1a214ff6            n/a
vault-ops-pro/   kv            kv_28b1ceaa             Earn Your HCVOP Certification
cloud-team-kv/   kv            kv_fa270a3f             n/a
cubbyhole/       cubbyhole     cubbyhole_88c8e2e3      per-token private secret storage
dev-team-kv/     kv            kv_55c319c4             n/a
identity/        identity      identity_e60e93cb       identity store
kv-v2/           kv            kv_eea3206c             n/a
sys/             system        system_66b0d8ee         system endpoints used for control
transit/         transit       transit_7b8038ca        n/a

Enabling Engines via UI

1. Open the Vault UI and navigate to the Secrets tab.
2. Click Enable New Secrets Engine.
3. Select an engine type, configure the mount path and options, then click Save.
4. For engines not fully supported in the UI, switch to the CLI or API for advanced settings.

Next Steps

Now that you’ve learned how to enable and manage Vault Secrets Engines, the next sections will dive deeper into configuring each engine:

1. Key/Value (KV) Secrets Engine
2. Database Secrets Engine
3. Public Key Infrastructure (PKI)
4. Transit Secrets Engine
5. Identity and Cubbyhole Engines

Stay tuned to master dynamic secrets, encryption, and certificate automation in HashiCorp Vault.

Links and References

• HashiCorp Vault Documentation
• Vault CLI Commands
• HashiCorp Learn: Vault Secrets Engines