I85PREP
⌘ K
Vault Associate study materials
Vault Associate study resources

Vault Associate: Configure Secrets Engines

Vault Associate · Work through your exam, one topic at a time.

All guide sections

Configure Secrets Engines

Mounting engines

Each secrets engine is enabled at a unique path: vault secrets enable -path=kv -version=2 kv. The path appears in every API call, so two KV mounts with different versions can coexist. vault secrets list -detailed shows path, type, version, and TTLs; vault secrets tune -max-lease-ttl=24h kv adjusts limits; vault secrets disable kv/ removes the mount, its data, and revokes its leases.

What each engine does

  • kv: static storage, v1 or v2 decided at enable time.
  • database: roles map to SQL statements; reading credentials creates users.
  • aws / azure / gcp: dynamic cloud credentials from configured roles.
  • pki: issue, renew, and revoke certificates via root and intermediate endpoints.
  • transit: encryption as a service - keys never leave Vault.
  • ssh: signed certificates or one-time passwords.
  • identity and cubbyhole: enabled by default and treated specially.

Traps

  • The KV version cannot be changed after enabling; you must disable (losing data) and re-enable.
  • Enabling an engine at a path that is already in use fails.
  • Tuning TTLs does not retroactively shorten existing leases.
  • vault secrets move relocates a mount but breaks policies that reference the old path.
  • Disabling a mount deletes its configuration and data - a destructive operation.

Rule of thumb: choose the KV version and mount path before writing any policy, because the path is baked into every policy and moving it later means rewriting policies and migrating data.