HashiCorp Vault

Details

ID	`HashiCorp Vault`
Provider	IBM
Category	Authentication & Identity Management
From Version	5.0.0
Docker Image	`demisto/vendors-sdk:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

Secure, store, and tightly control access to tokens, passwords, certificates, and encryption keys for protecting secrets and other sensitive data using HashiCorp Vault. This integration fetches credentials. For more information, see Managing Credentials.

This integration was integrated and tested with version 1.12.2 of HashiCorp Vault.

Authentication

The integration supports the following auth methods:

Userpass Auth Method

You are required to fill in only the Username / Role ID parameter with the username and Password / Secret ID parameter with the password. For more details, see the HashiCorp Vault documentation.

Token Auth Method

You are required to fill in only the Authentication token parameter. For more details, see the HashiCorp Vault documentation.

AppRole Auth Method

You are required to fill in only the Username / Role ID parameter with the role ID and Password / Secret ID parameter with the secret ID, and check the Use AppRole Auth Method checkbox. For more details, see the HashiCorp Vault documentation.

Configure HashiCorp Vault in Cortex

Parameter	Description	Required
HashiCorp server URL (e.g., https://192.168.0.1:8200)	The server URL	True
Use AppRole Auth Method	Set as true if you are using the AppRole method for authentication.	False
Username / Role ID	The username for the Hashicorp vault.	False
Password / Secret ID	The password for the Hashicorp vault.	False
Cache the authentication token	enables caching of the authentication token.	False
Authentication token	A token for authentication for the Hashicorp vault. (Use instead of password and username.)	False
Vault enterprise namespace	The namespace used for the vault by the user.	False
Trust any certificate (not secure)	Mark as true to make unverified HTTP requests.	False
Use system proxy settings	Mark as true to use proxy settings.	False
Fetches credentials	Mark as true to fetch credentials to the Cortex XSOAR credentials vault.	False
CSV list of secrets engine types to fetch secrets from	Possible values are KV, Cubbyhole, AWS.	False
Concat username to credential object name	Should be used in case there are several secrets under the same folder in order to make the credential object unique.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

hashicorp-list-secrets-engines

List all secrets engines that exist in HashiCorp Vault.

Base Command

hashicorp-list-secrets-engines

Input

There are no input arguments.

Context Output

Path	Type	Description
HashiCorp.Engine.Type	string	Secrets engine type.
HashiCorp.Engine.Path	string	Secrets engine path in HashiCorp.
HashiCorp.Engine.Description	string	Secrets engine description.
HashiCorp.Engine.Accessor	string	Secrets engine accessor.

Command example

!hashicorp-list-secrets-engines

hashicorp-list-secrets

List secrets (names) for a specified KV engine.

Base Command

hashicorp-list-secrets

Input

Argument Name	Description	Required
engine	Engine path, e.g.,”secret/”. Use the list-secrets-engines command to retrieve the engine path.	Required
version	The version of the KV engine. Possible values are: 1, 2. Default is 1.	Optional

Context Output

Path	Type	Description
HashiCorp.Secret.Path	string	Secret path

Command example

!hashicorp-list-secrets

hashicorp-get-secret-metadata

Returns information about a specified secret in a specified KV V2 engine.

Base Command

hashicorp-get-secret-metadata

Input

Argument Name	Description	Required
engine_path	KV Engine path, e.g., “kv/”.	Required
secret_path	Secret path, e.g., “secret”.	Required

Context Output

Path	Type	Description
HashiCorp.Secret.Created	date	Secret creation time.
HashiCorp.Secret.Version.Destroyed	boolean	Is the version destroyed.
HashiCorp.Secret.Version.Created	number	Version creation time.
HashiCorp.Secret.Version.Deleted	date	Version deletion time.
HashiCorp.Secret.Updated	date	Secret last updated time.
HashiCorp.Secret.Engine	string	Secret engine type.
HashiCorp.Secret.CurrentVersion	number	Secret current version.
HashiCorp.Secret.Path	string	Secret path.
HashiCorp.Secret.CustomMetadata	unknown	The custom metadata saved in the secret.

Command example

!hashicorp-get-secret-metadata engine_path=secret secret_path=test

hashicorp-delete-secret

Deletes the data under a specified secret given the secret path. Performs a soft delete that allows you to run the hashicorp-undelete-secret command if necessary (for KV V2 engine).

Base Command

hashicorp-delete-secret

Input

Argument Name	Description	Required
secret_path	Secret path, e.g., “secret”.	Required
engine_path	Engine path, e.g.,”secret/”.	Required
versions	CSV list of secret versions to delete.	Required

Context Output

There is no context output for this command.

Command example

!hashicorp-delete-secret engine_path=secret secret_path=test versions=2

hashicorp-undelete-secret

Undeletes (restores) a secret on HashiCorp (for KV V2 engine).

Base Command

hashicorp-undelete-secret

Input

Argument Name	Description	Required
secret_path	Secret path, e.g., “secret”.	Required
engine_path	Engine path, e.g.,”secret/”.	Required
versions	CSV list of secret versions to undelete (restore).	Required

Context Output

There is no context output for this command.

Command example

!hashicorp-undelete-secret engine_path=secret secret_path=test versions=2

hashicorp-destroy-secret

Permanently deletes a secret (for KV V2 engine).

Base Command

hashicorp-destroy-secret

Input

Argument Name	Description	Required
secret_path	Secret path, .e.g., “secret”.	Required
engine_path	Engine path, e.g.,”secret/”.	Required
versions	CSV list of secret versions to permanently delete.	Required

Context Output

There is no context output for this command.

Command example

!hashicorp-destroy-secret engine_path=secret secret_path=test versions=2

hashicorp-disable-engine

When a secrets engine is no longer needed, it can be disabled. All secrets under the engine are revoked and the corresponding vault data and configurations are removed.

Base Command

hashicorp-disable-engine

Input

Argument Name	Description	Required
path	Path of the secrets engine to disable.	Required

Context Output

There is no context output for this command.

Command example

!hashicorp-disable-engine path=secret

hashicorp-enable-engine

***!hashicorp-disable-engine path=secret
Enables a new secrets engine at the specified path.

Base Command

hashicorp-enable-engine

Input

Argument Name	Description	Required
path	The path where the secrets engine will be mounted.	Required
type	Type of backend, e.g., “aws”.	Required
description	Friendly description of the mount.	Optional
default_lease_ttl	The default lease duration, specified as a string duration, e.g., “5s” or “30m”.	Optional
max_lease_ttl	The maximum lease duration, specified as a string duration, e.g., “5s” or “30m”.	Optional
force_no_cache	Whether to disable caching.	Optional
audit_non_hmac_request_keys	CSV list of keys that will not be HMAC’d by audit devices in the request data object.	Optional
audit_non_hmac_response_keys	CSV list of keys that will not be HMAC’d by audit devices in the response data object.	Optional
listing_visibility	Whether to show this mount in the UI-specific listing endpoint. Default is hidden. Possible values are: unauth, hidden.	Optional
passthrough_request_headers	CSV list of headers to add to allow list and pass from the request to the backend.	Optional
kv_version	KV version to mount. Set to “2” for mount KV V2. Possible values are: 1, 2.	Optional
local	Specifies if the secrets engine is a local mount only. Local mounts are not replicated, nor (if a secondary) removed by replication. Supported only in Vault Enterprise.	Optional
seal_wrap	Enable seal wrapping for the mount. Supported only in Vault Enterprise.	Optional

Context Output

There is no context output for this command.

Command example

!hashicorp-enable-engine path=secret type=AWS

hashicorp-list-policies

Lists all configured policies.

Base Command

hashicorp-list-policies

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path	Type	Description
HashiCorp.Policy.Name	string	Policy name.

Command example

hashicorp-list-policies

hashicorp-get-policy

Get information for a policy.

Base Command

hashicorp-get-policy

Input

Argument Name	Description	Required
name	Policy name.	Required

Context Output

Path	Type	Description
HashiCorp.Policy.Name	string	Policy name.
HashiCorp.Policy.Rule.Path	string	Policy rule path.
HashiCorp.Policy.Rule.Capabilities	unknown	Policy rule capabilities.

Command example

!hashicorp-get-policy name=secret

hashicorp-seal-vault

If you suspect your data has been compromised, you can seal your vault to prevent access to your secrets.

Base Command

hashicorp-seal-vault

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command example

!hashicorp-seal-vault

hashicorp-unseal-vault

Use a single master key share to unseal the vault. If the master key shares threshold is met, the key will attempt to unseal the vault. Otherwise, this API must be called until the threshold is met.

Base Command

hashicorp-unseal-vault

Input

Argument Name	Description	Required
key	Single master key .	Optional
reset	Reset the unseal project. Possible values are: true.	Optional

Context Output

There is no context output for this command.

Command example

!hashicorp-unseal-vault

hashicorp-configure-engine

Configure a secrets engine to fetch secrets from.

Base Command

hashicorp-configure-engine

Input

Argument Name	Description	Required
path	The engine path, e.g., “secret/”.	Required
folder	Specific folder to fetch secrets from, e.g., “secret-folder/”. (Supported only for engine type KV2.)	Optional
type	The engine type, e.g., “KV”. Possible values are: KV, Cubbyhole, AWS.	Required
version	The engine version (for KV engines). Possible values are: 1, 2.	Optional
aws_roles_list	A comma-delimited list of roles names to generate credentials for. If not mentioned, we will generate credentials for all roles in the path.(used for only for AWS).	Optional
aws_method	A parameter to indicate which type of request we would like to use to generate credentials(used for only for AWS).	Optional

Context Output

There is no context output for this command.

Command example

!hashicorp-configure-engine type=type version=2 path=path ttl=3600

Human Readable Output

Engine configured successfully

hashicorp-reset-configuration

Reset the engine configuration.

Base Command

hashicorp-reset-configuration

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

Command example

!hashicorp-reset-configuration

Human Readable Output

Successfully reset the engine configuration.

hashicorp-create-token

Create a new authentication token.

Base Command

hashicorp-create-token

Input

Argument Name	Description	Required
role_name	The name of the token role.	Optional
policies	CSV list of policies for the token. This must be a subset of the policies belonging to the token making the request, unless root. If policies are not specified, all policies of the calling token are applied to the new token.	Optional
meta	A map of string-to-string valued metadata. This is passed through to the audit devices.	Optional
no_parent	If true and set by a root caller, the token will not have the parent token of the caller. This creates a token with no parent. Possible values are: true, false.	Optional
no_default_policy	If true the default policy will not be included in this token’s policy set. Possible values are: true, false.	Optional
renewable	If set to false, the token cannot be renewed past its initial TTL. If set to true, the token can be renewed up to the system/mount maximum TTL. Possible values are: true, false.	Optional
ttl	The TTL (lease duration) period of the token, provided as “10m” or “1h”, where hour is the largest suffix. If not provided, the token is valid for the default lease TTL, or indefinitely if the root policy is used.	Optional
explicit_max_ttl	If set, the token will have an explicit max TTL applied to it. The maximum token TTL cannot be changed later, and unlike with normal tokens, updates to the system/mount max TTL value will have no effect at renewal time. The token can never be renewed or used past the value set at issue time.	Optional
display_name	The display name of the token.	Optional
num_uses	The maximum number of times the token can be used. Supply this argument to create a one-time-token, or limited use token. The value of 0 has no limit to the number of uses.	Optional
period	If specified, the token will be periodic. It will not have a maximum TTL (unless an “explicit-max-ttl” is also set), but every renewal will use the given period. Requires a root/sudo token to use.	Optional

Context Output

Path	Type	Description
HashiCorp.Auth.Token	string	Authentication token.
HashiCorp.Auth.Policy	unknown	Authentication policies.
HashiCorp.Auth.LeaseDuration	number	Authentication lease duration in seconds, 0 if indefinitely.

Command example

!hashicorp-create-token display_name=token explicit_max_ttl=3600 renewable=false

hashicorp-generate-role-secret

Generates and issues a new SecretID on an existing AppRole.

Base Command

hashicorp-generate-role-secret

Input

Argument Name	Description	Required
role_name	The name of the AppRole.	Required
meta_data	Metadata to be tied to the SecretID.	Optional
cidr_list	Comma separated string or list of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses.	Optional
token_bound_cidrs	Comma-separated string or list of CIDR blocks.	Optional
num_uses	Number of times this SecretID can be used, after which the SecretID expires. A value of zero will allow unlimited uses.	Optional
ttl_seconds	Duration in seconds after which this SecretID expires. A value of zero will allow the SecretID to not expire.	Optional

Context Output

There is no context output for this command.

Command example

!hashicorp-generate-role-secret role_name=my-role

Human Readable Output

SecretID:123

hashicorp-get-role-id

Retrieves the AppRole ID for a specified role.

Base Command

hashicorp-get-role-id

Input

Argument Name	Description	Required
role_name	The name of the AppRole.	Required

Context Output

Path	Type	Description
HashiCorp.AppRole.Id	string	AppRole ID.
HashiCorp.AppRole.Name	string	AppRole Name.

Command example

!hashicorp-get-role-id role_name=my-role

Human Readable Output

Id	Name
role_id	role_name

Additional Information

In order to fetch credentials from HashiCorp Vault, the relevant secrets engines must be configured with the integration so it can pull the data from them. To configure an engine with the integration, use the configure-engine command.
The default fetch rate for fetch-credentials is 10 minutes. This is configurable with the server parameter vault.module.cache.expire

Known Limitations

Currently the integration is able to fetch credentials from the following engines:

K/V Versions 1,2
Cubbyhole
AWS

The following commands are limited to the K/V V2 engine

hashicorp-list-secrets
hashicorp-get-secret-metadata
hashicorp-delete-secret
hashicorp-undelete-secret
hashicorp-destroy-secret

Configuration parameters

server — HashiCorp server URL (e.g., https://192.168.0.1:8200) (required)
use_approle — Use AppRole Auth Method
credentials — Username / Role ID
cache_token — Cache the authentication token
token — Authentication token
credentials_token —
namespace — Vault enterprise namespace
unsecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetchCredentials — Fetches credentials
engines — CSV list of secrets engine types to fetch secrets from
concat_username_to_cred_name — Concat username to credential object name

Commands (17)

hashicorp-configure-engine
Configure a secrets engine to fetch secrets from.
hashicorp-create-token
Creates a new authentication token.
hashicorp-delete-secret
Deletes the data under a specified secret given the secret path. Performs a soft delete that allows you to run the hashicorp-undelete-secret command if necessary (for KV V2 engine).
hashicorp-destroy-secret
Permanently deletes a secret (for KV V2 engine).
hashicorp-disable-engine
When a secrets engine is no longer needed, it can be disabled. All secrets under the engine are revoked and the corresponding vault data and configurations are removed.
hashicorp-enable-engine
Enables a new secrets engine at the specified path.
hashicorp-generate-role-secret
Generates and issues a new SecretID on an existing AppRole.
hashicorp-get-policy
Get information for a policy.
hashicorp-get-role-id
Retrieves the AppRole ID for a specified role.
hashicorp-get-secret-metadata
Returns information about a specified secret in a specified KV V2 engine.
hashicorp-list-policies
Lists all configured policies.
hashicorp-list-secrets
List secrets (names) for a specified KV engine.
hashicorp-list-secrets-engines
List all secrets engines that exist in HashiCorp Vault.
hashicorp-reset-configuration
Reset the engines configuration.
hashicorp-seal-vault
If you suspect your data has been compromised, you can seal your vault to prevent access to your secrets.
hashicorp-undelete-secret
Undeletes (restores) a secret on HashiCorp (for KV V2 engine).
hashicorp-unseal-vault
Use a single master key share to unseal the vault. If the master key shares threshold is met, the vault will attempt to unseal the vault. Otherwise, this API must be called until the threshold is met.

Source

HashiCorpVault.py HashiCorpVault_test.py HashiCorpVault.yml HashiCorpVault_description.md command_examples.txt

Download History Raw

commonfields:
  id: HashiCorp Vault
  version: -1
name: HashiCorp Vault
display: HashiCorp Vault
category: Authentication & Identity Management
provider: IBM
sectionorder:
- Connect
- Collect
description: Manage Secrets and Protect Sensitive Data through HashiCorp Vault.
configuration:
- display: HashiCorp server URL (e.g., https://192.168.0.1:8200)
  name: server
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: Use AppRole Auth Method
  name: use_approle
  type: 8
  required: false
  section: Connect
- display: Username / Role ID
  displaypassword: Password / Secret ID
  name: credentials
  defaultvalue: ""
  type: 9
  required: false
  section: Connect
- display: Cache the authentication token
  additionalinfo: Is relevant only for Username/Password, or AppRole combinations.
  name: cache_token
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Authentication token
  name: token
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: Authentication token
  name: credentials_token
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- display: Vault enterprise namespace
  name: namespace
  defaultvalue: ""
  type: 0
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetches credentials
  name: isFetchCredentials
  defaultvalue: "true"
  type: 8
  required: false
  section: Collect
- display: CSV list of secrets engine types to fetch secrets from
  additionalinfo: Possible values are KV, Cubbyhole, AWS.
  name: engines
  defaultvalue: KV,Cubbyhole
  type: 0
  required: false
  section: Collect
- display: Concat username to credential object name
  name: concat_username_to_cred_name
  type: 8
  additionalinfo: Should be used in case there are several secrets under the same folder in order to make the credential object unique.
  required: false
  section: Collect
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: hashicorp-list-secrets-engines
    arguments: []
    outputs:
    - contextPath: HashiCorp.Engine.Type
      description: Secrets engine type.
      type: string
    - contextPath: HashiCorp.Engine.Path
      description: Secrets engine path in HashiCorp.
      type: string
    - contextPath: HashiCorp.Engine.Description
      description: Secrets engine description.
      type: string
    - contextPath: HashiCorp.Engine.Accessor
      description: Secrets engine accessor.
      type: string
    description: List all secrets engines that exist in HashiCorp Vault.
  - name: hashicorp-list-secrets
    arguments:
    - name: engine
      required: true
      default: true
      description: Engine path, e.g.,"secret/". Use the list-secrets-engines command to retrieve the engine path.
    - name: version
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      description: The version of the KV engine.
      defaultValue: "1"
    outputs:
    - contextPath: HashiCorp.Secret.Path
      description: Secret path.
      type: string
    description: List secrets (names) for a specified KV engine.
  - name: hashicorp-get-secret-metadata
    arguments:
    - name: engine_path
      required: true
      description: KV Engine path, e.g., "kv/".
    - name: secret_path
      required: true
      description: Secret path, e.g., "secret".
    outputs:
    - contextPath: HashiCorp.Secret.Created
      description: Secret creation time.
      type: date
    - contextPath: HashiCorp.Secret.Version.Destroyed
      description: Is the version destroyed.
      type: boolean
    - contextPath: HashiCorp.Secret.Version.Created
      description: Version creation time.
      type: number
    - contextPath: HashiCorp.Secret.Version.Deleted
      description: Version deletion time.
      type: date
    - contextPath: HashiCorp.Secret.Updated
      description: Secret last updated time.
      type: date
    - contextPath: HashiCorp.Secret.Engine
      description: Secret engine type.
      type: string
    - contextPath: HashiCorp.Secret.CurrentVersion
      description: Secret current version.
      type: number
    - contextPath: HashiCorp.Secret.Path
      description: Secret path.
      type: string
    - contextPath: HashiCorp.Secret.CustomMetadata
      description: The custom metadata saved in the secret.
    description: Returns information about a specified secret in a specified KV V2 engine.
  - name: hashicorp-delete-secret
    arguments:
    - name: secret_path
      required: true
      description: Secret path, e.g., "secret".
    - name: engine_path
      required: true
      description: Engine path, e.g.,"secret/".
    - name: versions
      required: true
      description: CSV list of secret versions to delete.
      isArray: true
    description: Deletes the data under a specified secret given the secret path. Performs a soft delete that allows you to run the hashicorp-undelete-secret command if necessary (for KV V2 engine).
  - name: hashicorp-undelete-secret
    arguments:
    - name: secret_path
      required: true
      description: Secret path, e.g., "secret".
    - name: engine_path
      required: true
      description: Engine path, e.g.,"secret/".
    - name: versions
      required: true
      description: CSV list of secret versions to undelete (restore).
      isArray: true
    description: Undeletes (restores) a secret on HashiCorp (for KV V2 engine).
  - name: hashicorp-destroy-secret
    arguments:
    - name: secret_path
      required: true
      description: Secret path, .e.g., "secret".
    - name: engine_path
      required: true
      description: Engine path, e.g.,"secret/".
    - name: versions
      required: true
      description: CSV list of secret versions to permanently delete.
      isArray: true
    description: Permanently deletes a secret (for KV V2 engine).
  - name: hashicorp-disable-engine
    arguments:
    - name: path
      required: true
      default: true
      description: Path of the secrets engine to disable.
    description: When a secrets engine is no longer needed, it can be disabled. All secrets under the engine are revoked and the corresponding vault data and configurations are removed.
  - name: hashicorp-enable-engine
    arguments:
    - name: path
      required: true
      description: The path where the secrets engine will be mounted.
    - name: type
      required: true
      description: Type of backend, e.g., "aws".
    - name: description
      description: Friendly description of the mount.
    - name: default_lease_ttl
      description: The default lease duration, specified as a string duration, e.g., "5s" or "30m".
    - name: max_lease_ttl
      description: The maximum lease duration, specified as a string duration, e.g., "5s" or "30m".
    - name: force_no_cache
      description: Whether to disable caching.
    - name: audit_non_hmac_request_keys
      description: CSV list of keys that will not be HMAC'd by audit devices in the request data object.
      isArray: true
    - name: audit_non_hmac_response_keys
      description: CSV list of keys that will not be HMAC'd by audit devices in the response data object.
      isArray: true
    - name: listing_visibility
      auto: PREDEFINED
      predefined:
      - unauth
      - hidden
      description: Whether to show this mount in the UI-specific listing endpoint. Default is hidden.
    - name: passthrough_request_headers
      description: CSV list of headers to add to allow list and pass from the request to the backend.
      isArray: true
    - name: kv_version
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      description: KV version to mount. Set to "2" for mount KV V2.
    - name: local
      description: Specifies if the secrets engine is a local mount only. Local mounts are not replicated, nor (if a secondary) removed by replication. Supported only in Vault Enterprise.
    - name: seal_wrap
      description: Enable seal wrapping for the mount. Supported only in Vault Enterprise.
    description: Enables a new secrets engine at the specified path.
  - name: hashicorp-list-policies
    arguments: []
    outputs:
    - contextPath: HashiCorp.Policy.Name
      description: Policy name.
      type: string
    description: Lists all configured policies.
  - name: hashicorp-get-policy
    arguments:
    - name: name
      required: true
      description: Policy name.
    outputs:
    - contextPath: HashiCorp.Policy.Name
      description: Policy name.
      type: string
    - contextPath: HashiCorp.Policy.Rule.Path
      description: Policy rule path.
      type: string
    - contextPath: HashiCorp.Policy.Rule.Capabilities
      description: Policy rule capabilities.
    description: Get information for a policy.
  - name: hashicorp-seal-vault
    arguments: []
    description: If you suspect your data has been compromised, you can seal your vault to prevent access to your secrets.
    execution: true
  - name: hashicorp-unseal-vault
    arguments:
    - name: key
      description: Single master key.
    - name: reset
      auto: PREDEFINED
      predefined:
      - "true"
      description: Reset the unseal project.
    description: Use a single master key share to unseal the vault. If the master key shares threshold is met, the vault will attempt to unseal the vault. Otherwise, this API must be called until the threshold is met.
  - name: hashicorp-configure-engine
    arguments:
    - name: path
      required: true
      description: The engine path, e.g., "secret/".
    - name: folder
      description: Specific folder to fetch secrets from, e.g., "secret-folder/". (Supported only for engine type KV2.)
    - name: aws_roles_list
      description: A comma-delimited list of roles names to generate credentials for. If not mentioned, we will generate credentials for all roles in the path.
    - name: aws_method
      auto: PREDEFINED
      predefined:
      - "GET"
      - "POST"
      description: A parameter to indicate which type of request we would like to use to generate credentials.
    - name: type
      auto: PREDEFINED
      predefined:
      - "KV"
      - "Cubbyhole"
      - "AWS"
      required: true
      description: The engine type, e.g., "KV".
    - name: version
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      description: The engine version (for KV engines); "1" or "2".
    description: Configure a secrets engine to fetch secrets from.
  - name: hashicorp-reset-configuration
    arguments: []
    description: Reset the engines configuration.
  - name: hashicorp-create-token
    arguments:
    - name: role_name
      description: The name of the token role.
    - name: policies
      description: CSV list of policies for the token. This must be a subset of the policies belonging to the token making the request, unless root. If policies are not specified, all policies of the calling token are applied to the new token.
      isArray: true
    - name: meta
      description: A map of string-to-string valued metadata. This is passed through to the audit devices.
    - name: no_parent
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: If true and set by a root caller, the token will not have the parent token of the caller. This creates a token with no parent.
    - name: no_default_policy
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: If true the default policy will not be included in this token's policy set.
    - name: renewable
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: If set to false, the token cannot be renewed past its initial TTL. If set to true, the token can be renewed up to the system/mount maximum TTL.
    - name: ttl
      description: The TTL(lease duration) period of the token, provided as "10m" or "1h", where hour is the largest suffix. If not provided, the token is valid for the default lease TTL, or indefinitely if the root policy is used.
    - name: explicit_max_ttl
      description: 'If set, the token will have an explicit max TTL applied to it. The maximum token TTL cannot be changed later, and unlike with normal tokens, updates to the system/mount max TTL value will have no effect at renewal time. The token can never be renewed or used past the value set at issue time.'
    - name: display_name
      description: The display name of the token.
    - name: num_uses
      description: The maximum number of times the token can be used. Supply this argument to create a one-time-token, or limited use token. The value of 0 has no limit to the number of uses.
    - name: period
      description: If specified, the token will be periodic. It will not have a maximum TTL (unless an "explicit-max-ttl" is also set), but every renewal will use the given period. Requires a root/sudo token to use.
    outputs:
    - contextPath: HashiCorp.Auth.Token
      description: Authentication token.
      type: string
    - contextPath: HashiCorp.Auth.Policy
      description: Authentication policies.
    - contextPath: HashiCorp.Auth.LeaseDuration
      description: Authentication lease duration in seconds, 0 if indefinitely.
      type: number
    description: Creates a new authentication token.
  - name: hashicorp-generate-role-secret
    arguments:
    - name: role_name
      required: true
      description: The name of the AppRole.
    - name: meta_data
      description: Metadata to be tied to the SecretID. 
    - name: cidr_list
      description: Comma separated string or list of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses.
      isArray: true
    - name: token_bound_cidrs
      description: Comma-separated string or list of CIDR blocks.
      isArray: true
    - name: num_uses
      description: Number of times this SecretID can be used, after which the SecretID expires. A value of zero will allow unlimited uses.
      type: number
    - name: ttl_seconds
      description: Duration in seconds after which this SecretID expires. A value of zero will allow the SecretID to not expire.
      type: number
    description: Generates and issues a new SecretID on an existing AppRole.
  - name: hashicorp-get-role-id
    arguments:
    - name: role_name
      required: true
      description: The name of the AppRole.
    outputs:
    - contextPath: HashiCorp.AppRole.Id
      description: AppRole ID.
      type: string
    - contextPath: HashiCorp.AppRole.Name
      description: AppRole Name.
      type: string
    description: Retrieves the AppRole ID for a specified role.
  dockerimage: demisto/vendors-sdk:1.0.0.10120494
tests:
- hashicorp_test
fromversion: 5.0.0