1

I have a question about when we configure the approle auth method of the vault, After the configuration of the approle, we need the role-id and secret-id to obtain the token and to do the further vault operations.

  1. vault write auth/approle/role/test-role token_ttl=15m token_max_ttl=30m

  2. vault read auth/approle/role/test-role/role-id

  3. vault write -f auth/approle/role/test-role/secret-id

  4. vault write auth/approle/login role_id=<role-id> secret_id=<secret-id>

Why there is not a read operation on secret-id ??

can't we just do this: vault read auth/approle/role/test-role/secret-id

Any Reason behind doing this?, and why there is a write operation on secret-id??

MaartenDev
  • 5,631
  • 5
  • 21
  • 33
tarun mittal
  • 331
  • 4
  • 13

1 Answers1

2

secret_id is somehow similar to a token: it is dynamic, TTLed and can (and should) be recreated with write multiple times. role_id, on the other hand, is a more static entity, something like a username.

muzzy
  • 21
  • 1
  • 3