commonfields:
  id: HashiCorp Vault
  version: -1
name: HashiCorp Vault
display: HashiCorp Vault
category: Authentication & Identity Management
provider: IBM
sectionorder:
- Connect
- Collect
description: Manage Secrets and Protect Sensitive Data through HashiCorp Vault.
configuration:
- display: HashiCorp server URL (e.g., https://192.168.0.1:8200)
  name: server
  defaultvalue: ""
  type: 0
  required: true
  section: Connect
- display: Use AppRole Auth Method
  name: use_approle
  type: 8
  required: false
  section: Connect
- display: Username / Role ID
  displaypassword: Password / Secret ID
  name: credentials
  defaultvalue: ""
  type: 9
  required: false
  section: Connect
- display: Cache the authentication token
  additionalinfo: Is relevant only for Username/Password, or AppRole combinations.
  name: cache_token
  defaultvalue: "false"
  type: 8
  required: false
  section: Connect
- display: Authentication token
  name: token
  defaultvalue: ""
  type: 4
  hidden: true
  required: false
  section: Connect
- displaypassword: Authentication token
  name: credentials_token
  hiddenusername: true
  type: 9
  required: false
  section: Connect
- display: Vault enterprise namespace
  name: namespace
  defaultvalue: ""
  type: 0
  required: false
  section: Connect
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetches credentials
  name: isFetchCredentials
  defaultvalue: "true"
  type: 8
  required: false
  section: Collect
- display: CSV list of secrets engine types to fetch secrets from
  additionalinfo: Possible values are KV, Cubbyhole, AWS.
  name: engines
  defaultvalue: KV,Cubbyhole
  type: 0
  required: false
  section: Collect
- display: Concat username to credential object name
  name: concat_username_to_cred_name
  type: 8
  additionalinfo: Should be used in case there are several secrets under the same folder in order to make the credential object unique.
  required: false
  section: Collect
script:
  script: ''
  type: python
  subtype: python3
  commands:
  - name: hashicorp-list-secrets-engines
    arguments: []
    outputs:
    - contextPath: HashiCorp.Engine.Type
      description: Secrets engine type.
      type: string
    - contextPath: HashiCorp.Engine.Path
      description: Secrets engine path in HashiCorp.
      type: string
    - contextPath: HashiCorp.Engine.Description
      description: Secrets engine description.
      type: string
    - contextPath: HashiCorp.Engine.Accessor
      description: Secrets engine accessor.
      type: string
    description: List all secrets engines that exist in HashiCorp Vault.
  - name: hashicorp-list-secrets
    arguments:
    - name: engine
      required: true
      default: true
      description: Engine path, e.g.,"secret/". Use the list-secrets-engines command to retrieve the engine path.
    - name: version
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      description: The version of the KV engine.
      defaultValue: "1"
    outputs:
    - contextPath: HashiCorp.Secret.Path
      description: Secret path.
      type: string
    description: List secrets (names) for a specified KV engine.
  - name: hashicorp-get-secret-metadata
    arguments:
    - name: engine_path
      required: true
      description: KV Engine path, e.g., "kv/".
    - name: secret_path
      required: true
      description: Secret path, e.g., "secret".
    outputs:
    - contextPath: HashiCorp.Secret.Created
      description: Secret creation time.
      type: date
    - contextPath: HashiCorp.Secret.Version.Destroyed
      description: Is the version destroyed.
      type: boolean
    - contextPath: HashiCorp.Secret.Version.Created
      description: Version creation time.
      type: number
    - contextPath: HashiCorp.Secret.Version.Deleted
      description: Version deletion time.
      type: date
    - contextPath: HashiCorp.Secret.Updated
      description: Secret last updated time.
      type: date
    - contextPath: HashiCorp.Secret.Engine
      description: Secret engine type.
      type: string
    - contextPath: HashiCorp.Secret.CurrentVersion
      description: Secret current version.
      type: number
    - contextPath: HashiCorp.Secret.Path
      description: Secret path.
      type: string
    - contextPath: HashiCorp.Secret.CustomMetadata
      description: The custom metadata saved in the secret.
    description: Returns information about a specified secret in a specified KV V2 engine.
  - name: hashicorp-delete-secret
    arguments:
    - name: secret_path
      required: true
      description: Secret path, e.g., "secret".
    - name: engine_path
      required: true
      description: Engine path, e.g.,"secret/".
    - name: versions
      required: true
      description: CSV list of secret versions to delete.
      isArray: true
    description: Deletes the data under a specified secret given the secret path. Performs a soft delete that allows you to run the hashicorp-undelete-secret command if necessary (for KV V2 engine).
  - name: hashicorp-undelete-secret
    arguments:
    - name: secret_path
      required: true
      description: Secret path, e.g., "secret".
    - name: engine_path
      required: true
      description: Engine path, e.g.,"secret/".
    - name: versions
      required: true
      description: CSV list of secret versions to undelete (restore).
      isArray: true
    description: Undeletes (restores) a secret on HashiCorp (for KV V2 engine).
  - name: hashicorp-destroy-secret
    arguments:
    - name: secret_path
      required: true
      description: Secret path, .e.g., "secret".
    - name: engine_path
      required: true
      description: Engine path, e.g.,"secret/".
    - name: versions
      required: true
      description: CSV list of secret versions to permanently delete.
      isArray: true
    description: Permanently deletes a secret (for KV V2 engine).
  - name: hashicorp-disable-engine
    arguments:
    - name: path
      required: true
      default: true
      description: Path of the secrets engine to disable.
    description: When a secrets engine is no longer needed, it can be disabled. All secrets under the engine are revoked and the corresponding vault data and configurations are removed.
  - name: hashicorp-enable-engine
    arguments:
    - name: path
      required: true
      description: The path where the secrets engine will be mounted.
    - name: type
      required: true
      description: Type of backend, e.g., "aws".
    - name: description
      description: Friendly description of the mount.
    - name: default_lease_ttl
      description: The default lease duration, specified as a string duration, e.g., "5s" or "30m".
    - name: max_lease_ttl
      description: The maximum lease duration, specified as a string duration, e.g., "5s" or "30m".
    - name: force_no_cache
      description: Whether to disable caching.
    - name: audit_non_hmac_request_keys
      description: CSV list of keys that will not be HMAC'd by audit devices in the request data object.
      isArray: true
    - name: audit_non_hmac_response_keys
      description: CSV list of keys that will not be HMAC'd by audit devices in the response data object.
      isArray: true
    - name: listing_visibility
      auto: PREDEFINED
      predefined:
      - unauth
      - hidden
      description: Whether to show this mount in the UI-specific listing endpoint. Default is hidden.
    - name: passthrough_request_headers
      description: CSV list of headers to add to allow list and pass from the request to the backend.
      isArray: true
    - name: kv_version
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      description: KV version to mount. Set to "2" for mount KV V2.
    - name: local
      description: Specifies if the secrets engine is a local mount only. Local mounts are not replicated, nor (if a secondary) removed by replication. Supported only in Vault Enterprise.
    - name: seal_wrap
      description: Enable seal wrapping for the mount. Supported only in Vault Enterprise.
    description: Enables a new secrets engine at the specified path.
  - name: hashicorp-list-policies
    arguments: []
    outputs:
    - contextPath: HashiCorp.Policy.Name
      description: Policy name.
      type: string
    description: Lists all configured policies.
  - name: hashicorp-get-policy
    arguments:
    - name: name
      required: true
      description: Policy name.
    outputs:
    - contextPath: HashiCorp.Policy.Name
      description: Policy name.
      type: string
    - contextPath: HashiCorp.Policy.Rule.Path
      description: Policy rule path.
      type: string
    - contextPath: HashiCorp.Policy.Rule.Capabilities
      description: Policy rule capabilities.
    description: Get information for a policy.
  - name: hashicorp-seal-vault
    arguments: []
    description: If you suspect your data has been compromised, you can seal your vault to prevent access to your secrets.
    execution: true
  - name: hashicorp-unseal-vault
    arguments:
    - name: key
      description: Single master key.
    - name: reset
      auto: PREDEFINED
      predefined:
      - "true"
      description: Reset the unseal project.
    description: Use a single master key share to unseal the vault. If the master key shares threshold is met, the vault will attempt to unseal the vault. Otherwise, this API must be called until the threshold is met.
  - name: hashicorp-configure-engine
    arguments:
    - name: path
      required: true
      description: The engine path, e.g., "secret/".
    - name: folder
      description: Specific folder to fetch secrets from, e.g., "secret-folder/". (Supported only for engine type KV2.)
    - name: aws_roles_list
      description: A comma-delimited list of roles names to generate credentials for. If not mentioned, we will generate credentials for all roles in the path.
    - name: aws_method
      auto: PREDEFINED
      predefined:
      - "GET"
      - "POST"
      description: A parameter to indicate which type of request we would like to use to generate credentials.
    - name: type
      auto: PREDEFINED
      predefined:
      - "KV"
      - "Cubbyhole"
      - "AWS"
      required: true
      description: The engine type, e.g., "KV".
    - name: version
      auto: PREDEFINED
      predefined:
      - "1"
      - "2"
      description: The engine version (for KV engines); "1" or "2".
    description: Configure a secrets engine to fetch secrets from.
  - name: hashicorp-reset-configuration
    arguments: []
    description: Reset the engines configuration.
  - name: hashicorp-create-token
    arguments:
    - name: role_name
      description: The name of the token role.
    - name: policies
      description: CSV list of policies for the token. This must be a subset of the policies belonging to the token making the request, unless root. If policies are not specified, all policies of the calling token are applied to the new token.
      isArray: true
    - name: meta
      description: A map of string-to-string valued metadata. This is passed through to the audit devices.
    - name: no_parent
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: If true and set by a root caller, the token will not have the parent token of the caller. This creates a token with no parent.
    - name: no_default_policy
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: If true the default policy will not be included in this token's policy set.
    - name: renewable
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: If set to false, the token cannot be renewed past its initial TTL. If set to true, the token can be renewed up to the system/mount maximum TTL.
    - name: ttl
      description: The TTL(lease duration) period of the token, provided as "10m" or "1h", where hour is the largest suffix. If not provided, the token is valid for the default lease TTL, or indefinitely if the root policy is used.
    - name: explicit_max_ttl
      description: 'If set, the token will have an explicit max TTL applied to it. The maximum token TTL cannot be changed later, and unlike with normal tokens, updates to the system/mount max TTL value will have no effect at renewal time. The token can never be renewed or used past the value set at issue time.'
    - name: display_name
      description: The display name of the token.
    - name: num_uses
      description: The maximum number of times the token can be used. Supply this argument to create a one-time-token, or limited use token. The value of 0 has no limit to the number of uses.
    - name: period
      description: If specified, the token will be periodic. It will not have a maximum TTL (unless an "explicit-max-ttl" is also set), but every renewal will use the given period. Requires a root/sudo token to use.
    outputs:
    - contextPath: HashiCorp.Auth.Token
      description: Authentication token.
      type: string
    - contextPath: HashiCorp.Auth.Policy
      description: Authentication policies.
    - contextPath: HashiCorp.Auth.LeaseDuration
      description: Authentication lease duration in seconds, 0 if indefinitely.
      type: number
    description: Creates a new authentication token.
  - name: hashicorp-generate-role-secret
    arguments:
    - name: role_name
      required: true
      description: The name of the AppRole.
    - name: meta_data
      description: Metadata to be tied to the SecretID. 
    - name: cidr_list
      description: Comma separated string or list of CIDR blocks enforcing secret IDs to be used from specific set of IP addresses.
      isArray: true
    - name: token_bound_cidrs
      description: Comma-separated string or list of CIDR blocks.
      isArray: true
    - name: num_uses
      description: Number of times this SecretID can be used, after which the SecretID expires. A value of zero will allow unlimited uses.
      type: number
    - name: ttl_seconds
      description: Duration in seconds after which this SecretID expires. A value of zero will allow the SecretID to not expire.
      type: number
    description: Generates and issues a new SecretID on an existing AppRole.
  - name: hashicorp-get-role-id
    arguments:
    - name: role_name
      required: true
      description: The name of the AppRole.
    outputs:
    - contextPath: HashiCorp.AppRole.Id
      description: AppRole ID.
      type: string
    - contextPath: HashiCorp.AppRole.Name
      description: AppRole Name.
      type: string
    description: Retrieves the AppRole ID for a specified role.
  dockerimage: demisto/vendors-sdk:1.0.0.10120494
tests:
- hashicorp_test
fromversion: 5.0.0