HashiCorp Vault is an open-source tool designed for managing secrets and protecting sensitive data in dynamic infrastructure environments. It is commonly used in DevOps, cloud-native, and microservices architectures. The combination of HashiCorp Vault with Terraform creates a pattern for Infrastructure as Code management of secret lifecycles, auth methods, policies, and dynamic credentials. The reference material centers on installing Vault on Ubuntu 24.04, preparing a development environment for Terraform against a Vault dev server, and using the Terraform Vault provider to interact with Vault resources via the Vault HTTP API.
The provider plugin is maintained by the Vault team at HashiCorp. The provider uses the Vault HTTP API to manage Vault resources through Terraform configuration. It does not connect directly to Vault’s storage backend, nor does it use the Vault UI to apply configuration files. It does not require a custom plugin before it can run. Terraform 0.12.x and above is required, with the latest stable release recommended whenever possible. Go 1.20 is required to build the provider plugin.
Installation and System Preparation on Ubuntu 24.04
Vault installation begins with system update and package management preparation. The commands are executed with sudo privileges to ensure correct permissions.
bash
sudo apt-get update && sudo apt-get upgrade -y
The HashiCorp apt repository is added by importing the GPG key and creating a signed sources list.
bash
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update && sudo apt install vault
After installation, the Vault service is enabled and started.
bash
systemctl daemon-reload
systemctl start vault
systemctl enable vault
systemctl status vault
The Vault UI is accessible at https://127.0.0.1:8200/. Key shares is where the total number of pieces to split the root key into is entered during initial unsealing.
Impact for operators: installing via the official apt repository ensures signature verification and version pinning. The signed-by directive prevents repository poisoning. Enabling the service ensures Vault starts on boot, which is critical for production availability.
Contextual connection: the same apt keyring steps appear in Terraform Vault integration demos where GPG is installed first.
bash
sudo apt update && sudo apt install gpg
Then the signing key is downloaded to a new keyring.
bash
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
Verification of the key fingerprint is performed.
bash
gpg --no-default-keyring --keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg --fingerprint
Vault Capabilities Relevant to Terraform
Vault provides:
- Secrets Management: Securely store and control access to tokens, passwords, certificates, API keys, and other sensitive data.
- Dynamic Secrets: Generate secrets on the fly, e.g., database credentials that expire after use.
- Data Encryption: Encrypt and decrypt data without storing it, using APIs.
- Access Control: Fine-grained policies to control who can access what.
- Audit Logs: Full traceability of access and actions taken.
Vault encrypts secrets and controls access with different permission levels. This minimizes risk of unauthorized access and keeps sensitive information safe. Centralized management eliminates scattered secrets, making it easier to control and audit who can access what. Vault can store various secrets from database credentials to cloud API keys and integrates with different tools and platforms.
The free open-source version has limited features; most businesses opt for the paid edition with additional functionalities like advanced auditing and disaster recovery.
Development Environment Setup for Terraform Against Vault
Preparing an environment before running Terraform against a Vault dev server requires specific steps.
- Start the dev server, then export VAULTADDR, VAULTCACERT, and VAULT_TOKEN environment variables.
The incorrect options are Install the Vault UI and log in manually, Restart Terraform until it detects the server, and Disable TLS so Terraform can connect without configuration.
A typical dev server start with TLS enabled uses:
bash
vault server -dev -dev-root-token-id root -dev-tls
The dev server listens on the loopback interface at 127.0.0.1 on TCP port 8200 with TLS enabled.
For a non-TLS demo on EC2:
bash
vault server -dev -dev-listen-address="0.0.0.0:8200"
Environment variable export:
bash
export VAULT_ADDR='http://0.0.0.0:8200'
Opening port 8200 in the EC2 instance security group allows UI access via the public IP and port 8200. Login as root uses Token as the default method. The token is displayed when the server starts.
Terraform Vault Provider Build and Usage
The provider plugin is maintained by the Vault team at HashiCorp. It is recommended to avoid placing secrets in Terraform config or state file wherever possible, and if placed there, steps should be taken to reduce and manage risk. A practical guide exists for Best Practices for Using HashiCorp Terraform with HashiCorp Vault.
Build prerequisites:
- Terraform 0.12.x and above, latest stable recommended
- Go 1.20 to build the provider plugin
- GOPATH correctly setup, with $GOPATH/bin added to $PATH
Clone repository steps:
bash
mkdir -p $GOPATH/src/github.com/hashicorp; cd $GOPATH/src/github.com/hashicorp
git clone [email protected]:hashicorp/terraform-provider-vault
cd $GOPATH/src/github.com/hashicorp/terraform-provider-vault
make build
If working on the provider, Go version 1.20+ is required and GOPATH must be correctly setup. To compile the provider, run make build.
Alternative clone via HTTPS for Vault core:
bash
mkdir -p $GOPATH/src/github.com/hashicorp && cd $_
git clone https://github.com/hashicorp/vault.git
cd vault
Installation via snap is also referenced:
bash
snap install vault
Integration Pattern with Terraform Cloud and HCP
The Terraform Cloud agent should be able to use private non-public networking leveraging HashiCorp Virtual Network. An example shows connecting Terraform to Vault using the Terraform Cloud agent when Terraform and Vault are on different networks. While the example shows HCP Terraform and HCP Vault Dedicated, the same pattern can be used for Terraform Enterprise and Vault Enterprise in different networks.
Recommended operational responsibilities for a platform team admin:
- Ensure integration between HCP Terraform and HCP Vault is established
- Establish appropriate mapping between Terraform projects, workspaces and Vault namespaces keeping RBAC and scalability as priorities
- Ensure appropriate Terraform workspaces are assigned correct variable sets with Vault static secrets and/or integrated with appropriate Vault namespaces and secret engines for dynamic credentials
- Ensure documentation is in a centralized location for the application team regarding this integration
- Set up periodic collaboration meetings with cross-functional teams to ensure integration objectives are met
The first step of integrating Terraform with Vault is to authenticate Terraform to Vault.
Infrastructure as Code Management of Vault Resources
Teams at HashiCups want to use Terraform to manage Vault because they want to leverage Infrastructure as Code to consistently manage Vault resources, such as auth methods, users, policies, and secrets engines.
Terraform supports Vault from deployment to on-going configuration.
In addition to CLI and API, Vault's capabilities are accessible using the Vault provider for Terraform. The Vault provider uses the Vault HTTP API to interact with Vault using a series of files called a configuration. This configuration and the provider manage the resources that Terraform creates in Vault.
Example workflow at HashiCups:
- Oliver and operations manage Vault. Part of Oliver's job is to create logins and passwords for developers.
- Danielle and development teams need to log in to Vault to create secrets used by services.
- Oliver will enable the userpass auth method, create a user, set a password, and create and attach a policy to the user. The development team needs a secrets engine, which Oliver will create.
- Danielle will then log into Vault using userpass auth method and create a secret.
- A new standard requires teams to manage infrastructure with Terraform. Danielle and Oliver want to use Infrastructure as Code to manage Vault.
To complete this tutorial you need the following:
bash
vault server -dev -dev-root-token-id root -dev-tls
The dev server listens on loopback at 127.0.0.1 on TCP port 8200 with TLS enabled.
Real-World Integration Example and Troubleshooting
A demo explores Terraform Vault integration with a real example and troubleshooting.
Steps referenced:
- Launch one EC2 instance with basic configuration and access it
- Update machine and install GPG
- Download signing key to new keyring
- Verify key fingerprint
- Clone Vault repository from GitHub
- Install Vault
- Start Vault with dev listen address
- Set environment variables VAULT_ADDR
- Open port 8200 in security group
- Access UI via public IP and port 8200
- Log in as root using Token method
The sequence demonstrates how network exposure, environment configuration, and authentication token handling affect Terraform connectivity.
Configuration Comparison Table
| Item | Dev Server | Production Install |
|---|---|---|
| Listen address | 127.0.0.1:8200 or 0.0.0.0:8200 | Systemd managed service |
| TLS | -dev-tls enabled | Requires proper certs |
| Root token | literal string root | Generated via key shares |
| Auth method | userpass enabled manually | Managed via Terraform |
| Secrets engine | Created manually | Terraform managed |
Conclusion
HashiCorp Vault Terraform integration shifts secret management from manual UI operations to declarative, versioned configuration. The Vault provider communicates via HTTP API, allowing Terraform to create auth methods, users, policies, and secrets engines consistently across environments. Installation on Ubuntu 24.04 via the signed apt repository provides a secure foundation. Dev server setup with exported VAULTADDR, VAULTCACERT, and VAULT_TOKEN prepares a local testbed for Terraform runs. Building the provider from source requires Go 1.20+ and a correct GOPATH, reinforcing the developer workflow. In enterprise settings, integration with Terraform Cloud agents and HCP Vault Dedicated via private networking requires mapping projects to namespaces and enforcing RBAC. The pattern enables Infrastructure as Code governance over secrets lifecycles while preserving Vault's dynamic secrets, audit logs, and fine-grained access control.