community.hashi_vault.vault_write lookup – Perform a write operation against HashiCorp Vault

Note

This lookup plugin is part of the community.hashi_vault collection (version 3.0.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.hashi_vault.

To use it in a playbook, specify: community.hashi_vault.vault_write.

New in version 2.4.0: of community.hashi_vault

Synopsis

  • Performs a generic write operation against a given path in HashiCorp Vault, returning any output.

Requirements

The below requirements are needed on the local controller node that executes this lookup.

Parameters

Parameter

Comments

_terms

string / required

Vault path(s) to be written to.

auth_method

string

Authentication method to be used.

none auth method was added in collection version 1.2.0.

cert auth method was added in collection version 1.4.0.

aws_iam_login was renamed aws_iam in collection version 2.1.0 and was removed in 3.0.0.

Choices:

  • token ← (default)

  • userpass

  • ldap

  • approle

  • aws_iam

  • jwt

  • cert

  • none

Configuration:

  • INI entry:

    [hashi_vault_collection]
    auth_method = token
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_AUTH_METHOD

    added in 0.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_auth_method

    added in 1.2.0 of community.hashi_vault

aws_access_key

aliases: aws_access_key_id

string

The AWS access key to use.

Configuration:

  • Environment variable: EC2_ACCESS_KEY

  • Environment variable: AWS_ACCESS_KEY

  • Environment variable: AWS_ACCESS_KEY_ID

aws_iam_server_id

string

added in 0.2.0 of community.hashi_vault

If specified, sets the value to use for the X-Vault-AWS-IAM-Server-ID header as part of GetCallerIdentity request.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    aws_iam_server_id = None
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_AWS_IAM_SERVER_ID

aws_profile

aliases: boto_profile

string

The AWS profile

Configuration:

  • Environment variable: AWS_DEFAULT_PROFILE

  • Environment variable: AWS_PROFILE

aws_secret_key

aliases: aws_secret_access_key

string

The AWS secret key that corresponds to the access key.

Configuration:

  • Environment variable: EC2_SECRET_KEY

  • Environment variable: AWS_SECRET_KEY

  • Environment variable: AWS_SECRET_ACCESS_KEY

aws_security_token

string

The AWS security token if using temporary access and secret keys.

Configuration:

  • Environment variable: EC2_SECURITY_TOKEN

  • Environment variable: AWS_SESSION_TOKEN

  • Environment variable: AWS_SECURITY_TOKEN

ca_cert

aliases: cacert

string

Path to certificate to use for authentication.

If not specified by any other means, the VAULT_CACERT environment variable will be used.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    ca_cert = None
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_CA_CERT

    added in 1.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_ca_cert

    added in 1.2.0 of community.hashi_vault

cert_auth_private_key

path

added in 1.4.0 of community.hashi_vault

For cert auth, path to the private key file to authenticate with, in PEM format.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    cert_auth_private_key = None
    
  • Environment variable: ANSIBLE_HASHI_VAULT_CERT_AUTH_PRIVATE_KEY

cert_auth_public_key

path

added in 1.4.0 of community.hashi_vault

For cert auth, path to the certificate file to authenticate with, in PEM format.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    cert_auth_public_key = None
    
  • Environment variable: ANSIBLE_HASHI_VAULT_CERT_AUTH_PUBLIC_KEY

data

dictionary

A dictionary to be serialized to JSON and then sent as the request body.

Default: {}

jwt

string

The JSON Web Token (JWT) to use for JWT authentication to Vault.

Configuration:

  • Environment variable: ANSIBLE_HASHI_VAULT_JWT

mount_point

string

Vault mount point.

If not specified, the default mount point for a given auth method is used.

Does not apply to token authentication.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    mount_point = None
    

    added in 1.5.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_MOUNT_POINT

    added in 1.5.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_mount_point

    added in 1.5.0 of community.hashi_vault

namespace

string

Vault namespace where secrets reside. This option requires HVAC 0.7.0+ and Vault 0.11+.

Optionally, this may be achieved by prefixing the authentication mount point and/or secret path with the namespace (e.g mynamespace/secret/mysecret).

If environment variable VAULT_NAMESPACE is set, its value will be used last among all ways to specify namespace.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    namespace = None
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_NAMESPACE

    added in 0.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_namespace

    added in 1.2.0 of community.hashi_vault

password

string

Authentication password.

Configuration:

  • Environment variable: ANSIBLE_HASHI_VAULT_PASSWORD

    added in 1.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_password

    added in 1.2.0 of community.hashi_vault

proxies

raw

added in 1.1.0 of community.hashi_vault

URL(s) to the proxies used to access the Vault service.

It can be a string or a dict.

If it’s a dict, provide the scheme (eg. http or https) as the key, and the URL as the value.

If it’s a string, provide a single URL that will be used as the proxy for both http and https schemes.

A string that can be interpreted as a dictionary will be converted to one (see examples).

You can specify a different proxy for HTTP and HTTPS resources.

If not specified, environment variables from the Requests library are used.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    proxies = None
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_PROXIES

  • Variable: ansible_hashi_vault_proxies

    added in 1.2.0 of community.hashi_vault

region

string

The AWS region for which to create the connection.

Configuration:

  • Environment variable: EC2_REGION

  • Environment variable: AWS_REGION

retries

raw

added in 1.3.0 of community.hashi_vault

Allows for retrying on errors, based on the Retry class in the urllib3 library.

This collection defines recommended defaults for retrying connections to Vault.

This option can be specified as a positive number (integer) or dictionary.

If this option is not specified or the number is 0, then retries are disabled.

A number sets the total number of retries, and uses collection defaults for the other settings.

A dictionary value is used directly to initialize the Retry class, so it can be used to fully customize retries.

For detailed information on retries, see the collection User Guide.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    retries = None
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_RETRIES

  • Variable: ansible_hashi_vault_retries

retry_action

string

added in 1.3.0 of community.hashi_vault

Controls whether and how to show messages on retries.

This has no effect if a request is not retried.

Choices:

  • ignore

  • warn ← (default)

Configuration:

  • INI entry:

    [hashi_vault_collection]
    retry_action = warn
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_RETRY_ACTION

  • Variable: ansible_hashi_vault_retry_action

role_id

string

Vault Role ID or name. Used in approle, aws_iam, and cert auth methods.

For cert auth, if no role_id is supplied, the default behavior is to try all certificate roles and return any one that matches.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    role_id = None
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_ROLE_ID

    added in 0.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_role_id

    added in 1.2.0 of community.hashi_vault

secret_id

string

Secret ID to be used for Vault AppRole authentication.

Configuration:

  • Environment variable: ANSIBLE_HASHI_VAULT_SECRET_ID

    added in 0.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_secret_id

    added in 1.2.0 of community.hashi_vault

timeout

integer

added in 1.3.0 of community.hashi_vault

Sets the connection timeout in seconds.

If not set, then the hvac library’s default is used.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    timeout = None
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_TIMEOUT

  • Variable: ansible_hashi_vault_timeout

token

string

Vault token. Token may be specified explicitly, through the listed [env] vars, and also through the VAULT_TOKEN env var.

If no token is supplied, explicitly or through env, then the plugin will check for a token file, as determined by token_path and token_file.

The order of token loading (first found wins) is token param -> ansible var -> ANSIBLE_HASHI_VAULT_TOKEN -> VAULT_TOKEN -> token file.

Configuration:

  • Environment variable: ANSIBLE_HASHI_VAULT_TOKEN

    added in 0.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_token

    added in 1.2.0 of community.hashi_vault

token_file

string

If no token is specified, will try to read the token from this file in token_path.

Default: “.vault-token”

Configuration:

  • INI entry:

    [hashi_vault_collection]
    token_file = .vault-token
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_TOKEN_FILE

    added in 0.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_token_file

    added in 1.2.0 of community.hashi_vault

token_path

string

If no token is specified, will try to read the token_file from this path.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    token_path = None
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_TOKEN_PATH

    added in 0.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_token_path

    added in 1.2.0 of community.hashi_vault

token_validate

boolean

added in 0.2.0 of community.hashi_vault

For token auth, will perform a lookup-self operation to determine the token’s validity before using it.

Disable if your token does not have the lookup-self capability.

The default value is true.

The default value will change to false in version 4.0.0.

Choices:

  • no

  • yes

Configuration:

  • INI entry:

    [hashi_vault_collection]
    token_validate = None
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_TOKEN_VALIDATE

  • Variable: ansible_hashi_vault_token_validate

    added in 1.2.0 of community.hashi_vault

url

string

URL to the Vault service.

If not specified by any other means, the value of the VAULT_ADDR environment variable will be used.

If VAULT_ADDR is also not defined then an error will be raised.

Configuration:

  • INI entry:

    [hashi_vault_collection]
    url = None
    

    added in 1.4.0 of community.hashi_vault

  • Environment variable: ANSIBLE_HASHI_VAULT_ADDR

    added in 0.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_url

    added in 1.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_addr

    added in 1.2.0 of community.hashi_vault

username

string

Authentication user name.

Configuration:

  • Environment variable: ANSIBLE_HASHI_VAULT_USERNAME

    added in 1.2.0 of community.hashi_vault

  • Variable: ansible_hashi_vault_username

    added in 1.2.0 of community.hashi_vault

validate_certs

boolean

Controls verification and validation of SSL certificates, mostly you only want to turn off with self signed ones.

Will be populated with the inverse of VAULT_SKIP_VERIFY if that is set and validate_certs is not explicitly provided.

Will default to true if neither validate_certs or VAULT_SKIP_VERIFY are set.

Choices:

  • no

  • yes

Configuration:

  • Variable: ansible_hashi_vault_validate_certs

    added in 1.2.0 of community.hashi_vault

wrap_ttl

string

Specifies response wrapping token creation with duration. For example 15s, 20m, 25h.

Configuration:

  • Variable: ansible_hashi_vault_wrap_ttl

Notes

Note

  • vault_write is a generic plugin to do operations that do not yet have a dedicated plugin. Where a specific plugin exists, that should be used instead.

  • In the vast majority of cases, it will be better to do writes as a task, with the community.hashi_vault.vault_write module.

  • The lookup can be used in cases where you need a value directly in templating, but there is risk of executing the write many times unintentionally.

  • The lookup is best used for endpoints that directly manipulate the input data and return a value, while not changing state in Vault.

  • See the Lookup Guide for more information.

See Also

See also

community.hashi_vault.vault_write

The official documentation on the community.hashi_vault.vault_write module.

community.hashi_vault.vault_read lookup

The official documentation for the community.hashi_vault.vault_read lookup plugin.

community.hashi_vault.vault_read

The official documentation on the community.hashi_vault.vault_read module.

community.hashi_vault Lookup Guide

Guidance on using lookups in community.hashi_vault.

Examples

# These examples show some uses that might work well as a lookup.
# For most uses, the vault_write module should be used.

- name: Retrieve and display random data
  vars:
    data:
      format: hex
    num_bytes: 64
  ansible.builtin.debug:
    msg: "{{ lookup('community.hashi_vault.vault_write', 'sys/tools/random/' ~ num_bytes, data=data) }}"

- name: Hash some data and display the hash
  vars:
    input: |
      Lorem ipsum dolor sit amet, consectetur adipiscing elit.
      Pellentesque posuere dui a ipsum dapibus, et placerat nibh bibendum.
    data:
      input: '{{ input | b64encode }}'
    hash_algo: sha2-256
  ansible.builtin.debug:
    msg: "The hash is {{ lookup('community.hashi_vault.vault_write', 'sys/tools/hash/' ~ hash_algo, data=data) }}"


# In this next example, the Ansible controller's token does not have permission to read the secrets we need.
# It does have permission to generate new secret IDs for an approle which has permission to read the secrets,
# however the approle is configured to:
# 1) allow a maximum of 1 use per secret ID
# 2) restrict the IPs allowed to use login using the approle to those of the remote hosts
#
# Normally, the fact that a new secret ID would be generated on every loop iteration would not be desirable,
# but here it's quite convenient.

- name: Retrieve secrets from the remote host with one-time-use approle creds
  vars:
    role_id: "{{ lookup('community.hashi_vault.vault_read', 'auth/approle/role/role-name/role-id') }}"
    secret_id: "{{ lookup('community.hashi_vault.vault_write', 'auth/approle/role/role-name/secret-id') }}"
  community.hashi_vault.vault_read:
    auth_method: approle
    role_id: '{{ role_id }}'
    secret_id: '{{ secret_id }}'
    path: '{{ item }}'
  register: secret_data
  loop:
    - secret/data/secret1
    - secret/data/app/deploy-key
    - secret/data/access-codes/self-destruct


# This time we have a secret values on the controller, and we need to run a command the remote host,
# that is expecting to a use single-use token as input, so we need to use wrapping to send the data.

- name: Run a command that needs wrapped secrets
  vars:
    secrets:
      secret1: '{{ my_secret_1 }}'
      secret2: '{{ second_secret }}'
    wrapped: "{{ lookup('community.hashi_vault.vault_write', 'sys/wrapping/wrap', data=secrets) }}"
  ansible.builtin.command: 'vault unwrap {{ wrapped }}'

Return Values

Common return values are documented here, the following are the fields unique to this lookup:

Key

Description

_raw

list / elements=dictionary

The raw result of the write against the given path.

Returned: success

Authors

  • Brian Scholer (@briantist)

Hint

Configuration entries for each entry type have a low to high priority order. For example, a variable that is lower in the list will override a variable that is higher up.