HashiCorp

B Vault (self-managed and HCP Vault Dedicated)

Vault's JWT/OIDC auth method trusts any issuer you configure, so nothing needs a static Vault credential to get in. Going out, the AWS, GCP and Azure secrets engines can run keyless via plugin workload identity federation, but only on Vault Enterprise or HCP, and the remaining engines still want a static (rotatable) root credential.

Docs: developer.hashicorp.com · Checked 2026-09-16 · source YAML · dispute via PR

Inbound A

How a workload running anywhere authenticates to this product.

The JWT/OIDC auth method validates tokens from any issuer (OIDC discovery URL, JWKS URL or static public keys) with bound_audiences, bound_subject and bound_claims per role; native AWS, GCP, Azure and Kubernetes auth methods cover platform identities.

Issuers: any

developer.hashicorp.com checked 2026-09-16
“An OIDC Discovery URL and optional certificate chain is configured. Keys will be fetched from this URL during authentication.”
developer.hashicorp.com checked 2026-09-16
“If the JWT in the authentication request contains an aud claim, the associated bound_audiences for the role must exactly match at least one of the aud claims declared for the JWT.”
developer.hashicorp.com checked 2026-09-16
“The aws auth method provides an automated mechanism to retrieve a Vault token for IAM principals and AWS EC2 instances.”

Available in Community Edition, Enterprise and HCP Vault Dedicated. AppRole (RoleID + SecretID) is the static fallback for platforms with no identity; it is optional, not required.

Outbound Brequires Vault Enterprise 1.16+ (premium license) or HCP Vault Dedicated, for plugin WIF

How this product reaches into your cloud, repos, or other SaaS.

Plugin workload identity federation: Vault acts as an OIDC issuer and the AWS, GCP and Azure secrets engines exchange its identity token for cloud credentials with no static root key. Other engines (AliCloud, databases, and everything on Community Edition) still need a static root credential that Vault can rotate.

developer.hashicorp.com checked 2026-09-16
“The AWS secrets engine supports the Plugin WIF workflow, and has a source of identity called a plugin identity token.”
developer.hashicorp.com checked 2026-09-16
“Exchanging identity tokens for access tokens lets the GCP secrets engine operate without configuring explicit access to sensitive IAM security credentials.”
developer.hashicorp.com checked 2026-09-16
“Configure the audience claim value and the Client, Tenant and Subscription IDs for plugin workload identity federation”
developer.hashicorp.com checked 2026-09-16
“Vault Enterprise version 1.16 or later with premium license.”
developer.hashicorp.com checked 2026-09-16
“HCP Vault Dedicated is a hosted version of Vault Enterprise operated by HashiCorp”
developer.hashicorp.com checked 2026-09-16
“Configure that access key as the credentials that Vault will use to communicate with AliCloud to generate credentials”
developer.hashicorp.com checked 2026-09-16
“All plugins except MongoDB Atlas support rotating the root user's credentials.”

Graded at the top tier per the rubric and gated. On Community Edition every cloud secrets engine is configured with a static root access key or service-account key, which Vault can rotate on a schedule (rotate-root), so the un-gated grade would be C. Plugin WIF also requires the cloud to reach Vault's /.well-known/openid-configuration, so an air-gapped Vault cannot use it. AliCloud has no WIF option at all, which keeps the surface at B rather than A.

Hygiene for any static credential the product still issues

✓ Expiry enforceable	Every Vault token is capped by the system max TTL unless it is a root token (TTL 0 allowed) or a periodic token that keeps being renewed. AppRole SecretIDs take secret_id_ttl and secret_id_num_uses. developer.hashicorp.com checked 2026-09-16 “The system max TTL, which is 32 days but can be changed in Vault's configuration file.”
✓ Rotation via API	developer.hashicorp.com checked 2026-09-16 “/auth/token/create” developer.hashicorp.com checked 2026-09-16 “/auth/token/revoke”
✓ Scoped keys	developer.hashicorp.com checked 2026-09-16 “Policies are deny by default, so an empty policy grants no permission in the system.”
✗ Last-used visible	Token lookup returns creation_time, issue_time, expire_time, ttl and num_uses but no last-used timestamp; finding dead tokens means grepping the audit log. developer.hashicorp.com checked 2026-09-16 “creation_time”
✗ Leak revocation	Vault service, batch and root tokens are on GitHub's pattern list for user alerts and push protection, but not as partner patterns, and HashiCorp cannot revoke a token on a Vault it does not run. You get an alert, not a revocation. docs.github.com checked 2026-09-16 “HashiCorp Vault Service Token”

Notes

Hygiene is graded against the credentials Vault itself issues (tokens, AppRole SecretIDs). The static root credentials for secrets engines belong to the target cloud, not to Vault.

Badge

[![wif.tax grade](https://wif.tax/badge/hashicorp-vault.svg)](https://wif.tax/p/hashicorp-vault/)