Enable and Configure Secrets Engines

Secrets Engines are the heart of HashiCorp Vault, providing dynamic secrets, encryption, identity management, and more. In this guide, we’ll explore how to enable, configure, and manage Vault’s Secrets Engines—both generic and cloud-integrated—using the Vault CLI, API, and UI.

What are Vault Secrets Engines?
Generic vs. Cloud-Integrated Engines
Enabling Engines with CLI
Enabling Engines via UI
Next Steps

What Are Secrets Engines?

Vault Secrets Engines enable integration with external platforms and back-end systems by generating dynamic secrets, certificates, encryption, and identity data. While Vault supports a wide range of cloud providers and services, this tutorial focuses on the core generic engines tested in the HashiCorp Certified Vault Operations Professional exam.

The image lists various "Available Secrets Engines" related to Vault, including services like AWS, Google Cloud, and MongoDB Atlas. It also features a Vault certification badge and a cartoon character.

Generic Secrets Engines

Vault’s generic Secrets Engines do not require deep expertise in external platforms. These are commonly used across environments and covered in Vault certification:

Engine	Function	Key Features
Database	Dynamic database credentials	13+ platforms (MySQL, PostgreSQL, Oracle, etc.)
KV (v1/v2)	Key/Value storage	v1 (simple) & v2 (versioned, metadata)
PKI	Certificate issuance & management	X.509/TLS certificates
Transit	Encryption-as-a-Service	Data encryption, auto-unseal
Cubbyhole	Per-token private secret storage	Enabled by default
Identity	Identity data storage	Enabled by default

Enabling Secrets Engines

Engines can be enabled at a custom mount path using the Vault CLI, API, or UI. The UI offers a simple way to enable common engines, but some advanced configurations require CLI or API.

Use meaningful mount paths (e.g., prod-db/ or teams/cloud-kv/) to simplify management and auditing.

Enable with Vault CLI

The vault secrets command suite manages engine lifecycle:

enable: Mount a new engine
disable: Unmount an engine
list: View enabled engines
move: Rename or relocate a mount path
tune: Adjust engine settings (TTLs, descriptions)

# Enable AWS Secrets Engine at default path
vault secrets enable aws

# Disable the AWS Secrets Engine
vault secrets disable aws

# List all enabled Secrets Engines
vault secrets list

# Move a Secrets Engine to a new mount path
vault secrets move new-path/ old-path/

# Tune PKI engine default lease TTL to 72 hours
vault secrets tune -default-lease-ttl=72h pki/

# Enable KV v2 at custom path with description
vault secrets enable \
  --path="cloud-kv" \
  --description="My Secrets Engine" \
  kv-v2

# View detailed mount information
vault secrets list --detailed

Sample Output

Path             Type          Accessor                Description
----             ----          ---------               -----------
aws/             aws           aws_dafa7adc            n/a
azure/           aws           aws_1a214ff6            n/a
vault-ops-pro/   kv            kv_28b1ceaa             Earn Your HCVOP Certification
cloud-team-kv/   kv            kv_fa270a3f             n/a
cubbyhole/       cubbyhole     cubbyhole_88c8e2e3      per-token private secret storage
dev-team-kv/     kv            kv_55c319c4             n/a
identity/        identity      identity_e60e93cb       identity store
kv-v2/           kv            kv_eea3206c             n/a
sys/             system        system_66b0d8ee         system endpoints used for control
transit/         transit       transit_7b8038ca        n/a

Ensure your Vault token has the root policy or appropriate sys/mount and sys/cap capabilities to enable and configure Secrets Engines.

Enabling Engines via UI

Open the Vault UI and navigate to the Secrets tab.
Click Enable New Secrets Engine.
Select an engine type, configure the mount path and options, then click Save.
For engines not fully supported in the UI, switch to the CLI or API for advanced settings.

The image is a screenshot of a user interface for enabling secrets engines, showing a list of already enabled engines and an option to add more. It includes annotations and a cartoon character in the bottom right corner.

Next Steps

Now that you’ve learned how to enable and manage Vault Secrets Engines, the next sections will dive deeper into configuring each engine:

Key/Value (KV) Secrets Engine
Database Secrets Engine
Public Key Infrastructure (PKI)
Transit Secrets Engine
Identity and Cubbyhole Engines

Stay tuned to master dynamic secrets, encryption, and certificate automation in HashiCorp Vault.

Introduction

Create a working Vault server configuration given a scenario

Monitor a Vault Environment

Employ the Vault Security Model

Build Fault-Tolerant Vault Environments

Understand the Hardware Security Module (HSM) Integration

Scale Vault for Performance

Configure Access Control

Configure Vault Agent

Exam Experience and Expectations

Enable and Configure Secrets Engines

What Are Secrets Engines?

Generic Secrets Engines

Enabling Secrets Engines

Enable with Vault CLI

Sample Output

Enabling Engines via UI

Next Steps

Links and References

Watch Video

​What Are Secrets Engines?

​Generic Secrets Engines

​Enabling Secrets Engines

​Enable with Vault CLI

​Sample Output

​Enabling Engines via UI

​Next Steps

​Links and References

Watch Video

What Are Secrets Engines?

Generic Secrets Engines

Enabling Secrets Engines

Enable with Vault CLI

Sample Output

Enabling Engines via UI

Next Steps

Links and References