Vault Plugin Secrets Ejson

Vault Plugin: EJSON Secrets Backend

**NOTE: This project is not longer maintained.**

[](https://travis-ci.com/Shopify/vault-plugin-secrets-ejson)

Summary

A secret plugin for use with [Hashicorp Vault](https://www.github.com/hashicorp/vault). This plugin provides the ability to submit and manipulate [EJSON](https://github.com/Shopify/ejson) to Vault wherein it can be decrypted and/or stored.

Note: For storage operations, any key values prefixed with an underscore will be stored with the underscore removed at the decrypted path (see below for an example). This is done intentionally to keep data access sane.

Usage

Installing for development use

# Build the binary
$ make build

# Run Vault
# NOTE: Do not run -dev in production
$ vault server -dev -dev-root-token-id=root -dev-plugin-dir=./vault/plugins

# Export VAULT_ADDR for future `vault` commands
$ export VAULT_ADDR='http://127.0.0.1:8200'

# Enable the plugin at a specific path (in this case ejson/)
$ vault secrets enable -path=ejson secrets-ejson
Success! Enabled the vault-plugin-secrets-ejson plugin at: ejson/

Installing for production use

Please consult official Vault documentation on how to checksum, load and enable plugins.

Demo

Generating public-private-keypairs (/keypair)

$ vault write -force ejson/keypair
Key       Value
---       -----
public    7f0510f044e9ae852f8ae2865cce55ae01f3b9c0f505b1b33b6323579b778a30

$ vault list ejson/keys
Keys
----
7f0510f044e9ae852f8ae2865cce55ae01f3b9c0f505b1b33b6323579b778a30

$ vault read ejson/keys/7f0510f044e9ae852f8ae2865cce55ae01f3b9c0f505b1b33b6323579b778a30
Key        Value
---        -----
private    1430dc364475c63e21cc549ad74245970bfa70b98b9497e7f3c71dd3ce7cb13c

Storing public-private-keypairs (/keys/.*)

# Storing the public/private key for decryption
# This needs to be done first, and the secret must be