Vault Associate flashcards
Vault Associate · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Token auth method
- Built-in auth method at auth/token that cannot be disabled; every Vault request ultimately carries a token, and tokens are the base credential.
- AppRole credentials
- Machine authentication method using role_id and secret_id; secret_ids can be limited by TTL, use count, CIDR, and one-time use.
- Kubernetes auth binding
- Validates a service-account JWT with the Kubernetes TokenReview API; a role binds allowed namespaces and service accounts to Vault policies.
- Identity aliases
- Auth methods create identity aliases; aliases can be merged into one entity so a user or machine receives entity policies across methods.
- Policy capabilities
- HCL policy rules list capabilities such as create, read, update, patch, delete, list, sudo, and deny for a matching API path.
- Deny precedence
- If any attached policy contains deny for a path, the request is denied even when another policy allows the same path.
- Path wildcards
- Vault policy paths use plus (+) to match exactly one path segment and a trailing asterisk (*) to match a suffix.
- Default policy
- Automatically attached to tokens unless no_default_policy is set; it grants limited self-service actions such as token lookup and renewal.
- Batch tokens
- Lightweight tokens not persisted to storage, not renewable, and fixed-TTL; they carry data in the token and suit high-throughput short-lived workloads.
- Orphan token
- Token created without a parent; revoking its creator does not revoke it, so it must be managed and revoked separately.
- Token accessor
- Identifier for a token that permits lookup and revocation without exposing the token value; accessors are used for auditing and administration.
- Periodic token
- Token with a period value that can be renewed indefinitely if renewed before each period expires; it is not bounded by max_ttl.
- KV v2 data path
- KV version 2 read and write API paths include data/, for example secret/data/app; metadata operations use secret/metadata/app.
- Response wrapping
- Vault returns a single-use wrapping token instead of the secret; unwrapping with vault unwrap exchanges it for the original response.
- Dynamic secret lease
- Credential returned by engines such as database or AWS includes lease_id and lease_duration; Vault revokes the credential when the lease ends.
- Cubbyhole storage
- Per-token private key-value store; data is scoped to the owning token and is deleted when that token is revoked or expires.
- Enable secrets engine
- Command vault secrets enable -path=<path> <type> mounts an engine; the path becomes the API prefix for its operations.
- KV version 2
- KV engine mode enabled with -version=2; it adds data/ and metadata/ paths and supports versioning, CAS, and soft delete.
- Transit engine
- Secrets engine that performs encryption, decryption, signing, and HMAC without storing plaintext; named keys support rotation.
- Secrets tune
- vault secrets tune changes mount settings such as default_lease_ttl and max_lease_ttl for the secrets engine at that path.
- Barrier encryption
- Vault encrypts data before writing to storage; the barrier key protects data at rest and is unlocked during unseal.
- Integrated storage
- Raft-based storage backend built into Vault; it stores data on Vault nodes and requires a quorum of voting nodes for writes.
- Active standby HA
- In HA mode one node is active and handles writes; standby nodes forward or redirect requests and can take over after failover.
- Audit device failure
- If all enabled audit devices fail, Vault stops processing requests and fails closed to avoid unlogged secret access.
- Lease ID
- Unique identifier returned with dynamic credentials; used with lease lookup, renew, and revoke endpoints to manage the credential lifecycle.
- Lease renewal limit
- A lease can be renewed only until its max_ttl is reached; after that Vault refuses renewal and the credential must be reissued.
- Prefix lease revoke
- vault lease revoke -prefix <path> revokes every lease under a path prefix, useful for cleaning up an engine mount.
- Token lease cleanup
- Revoking a token also revokes leases created by that token, removing credentials issued under its authority.
- TLS listener
- Vault listener config uses tls_cert_file and tls_key_file; clients set VAULT_ADDR to https and VAULT_CACERT to trust the CA.
- Raft snapshot
- vault operator raft snapshot save writes a backup of integrated storage; restore uses vault operator raft snapshot restore with the snapshot file.
- Auto-unseal
- Delegates unsealing to a KMS or HSM configured in a seal stanza; recovery keys are used for privileged operations instead of unseal keys.
- Generate root token
- vault operator generate-root uses a quorum of unseal keys to create a new root token; the encoded token is decoded with the one-time password.