ConnectorTypeVAULT

class connector_types.connector_type_vault.ConnectorTypeVAULT

Interact with HashiCorp Vault

A single top-level operation selects what to do with Vault:

• operation_type='secret_engine' — read/upsert/delete/list/metadata via the Key-Value engine version 1 or 2; the engine (kv or kv-v2) and its mode are nested at operation['engine'].
• operation_type='token_create' — mint a token via the token auth method.

Input Schema

• schema_version = '2026-07-14'

  Type: string

• authentication

  Type: anyOf

  Options:

• scheme

  The scheme to use. https connections are encrypted with TLS/SSL and expose the TLS options.

  Type: anyOf

  Options:

• host

  The remote hostname or IP address.

  Type: string

• port

  Type: anyOf

  Options:

• path

  The path of the Vault server.

  Type: string

  Default: /

• operation

  Choose the Vault interaction: use a Key-Value secret engine, or run a token operation (e.g. create a token). Exactly one operation is performed per connection.

  Type: anyOf

  Options:

• allow_redirects

  If set to True redirects are followed and the response of the last non-redirect request is returned.

  If set to False redirects are not followed and the response of the first request is returned.

  Type: boolean

  Default: True

• max_redirects

  Maximum number of redirects to follow.

  Type: integer

  Default: 10

• total_timeout

  Total timeout for the request in seconds.

  Type: integer

  Default: 30

• connect_timeout

  A timeout for connecting to a peer in seconds.

  Type: integer

  Default: 30

• read_timeout

  A timeout for reading a portion of data from a peer in seconds.

  Type: integer

  Default: 30

• idempotent

  Whether re-running this connection from the start is safe (no duplicate side effects). Controls recovery after the connection between Cloudomation and the remote system is lost and later re-established (network glitch, workspace restart, ...): repeatable connections are left running to be reattached or re-run, others are cancelled. Leave unset to let the connector decide based on the operation.

Output Schema

Constants

supports_reconnect = False

Example

import flow_api

def handler(system: flow_api.System, this: flow_api.Execution, inputs: dict):
    # create a secret using token authentication
    this.connect(
        connector_type='VAULT',
        authentication={
            'authentication_method': 'token',
            'token': '...',
        },
        host='...',
        operation={
            'operation_type': 'secret_engine',
            'engine': {
                'engine_type': 'kv',
                'engine_path': '...',
                'mode': {
                    'mode_name': 'upsert',
                    'secret_path': '...',
                    'data': {
                        '...': '...',
                    },
                },
            },
        },
    )

    # read a KV-V2 secret using username and password authentication
    secret_value = this.connect(
        connector_type='VAULT',
        authentication={
            'authentication_method': 'username_password',
            'username': '...',
            'password': '...',
        },
        scheme={'scheme': 'http'},
        host='...',
        port={
            'port_mode': 'port_number',
            'port_number': 8080,
        },
        operation={
            'operation_type': 'secret_engine',
            'engine': {
                'engine_type': 'kv-v2',
                'engine_path': '...',
                'mode': {
                    'mode_name': 'read',
                    'secret_path': '...',
                    'version': 2,  # without a version being specified the latest version is read
                },
            },
        },
    ).get('output_value')['result']['data']['data']
    this.log(secret_value=secret_value)

    # destroy all versions of secret using client certificate authentication
    this.connect(
        connector_type='VAULT',
        authentication={
            'authentication_method': 'certificate',
        },
        host='...',
        scheme={
            'scheme': 'https',
            'client_cert': '...',
            'client_key': '...',
        },
        operation={
            'operation_type': 'secret_engine',
            'engine': {
                'engine_type': 'kv-v2',
                'engine_path': '...',
                'mode': {
                    'mode_name': 'delete_metadata',
                },
            },
        },
    )

    # mint a scoped child token via a token role using userpass login
    token = this.connect(
        connector_type='VAULT',
        name='mint operator ssh token',
        authentication={
            'authentication_method': 'username_password',
            'username': '...',
            'password': '...',
        },
        host='...',
        operation={
            'operation_type': 'token_create',
            'role': 'operator-ssh',
            'ttl': '1h',
            'num_uses': 2,
        },
    ).get('output_value')['result']['auth']['client_token']
    this.log(token=token)

    return this.success('all done')