HashiCorp Vault Secrets AI Skill Guide (Claude)

Overview & Engine Architecture

Vault centralizes secrets, encryption (Transit), and dynamic credentials (DB, PKI, cloud) behind authentication and ACL policies. Clients authenticate → receive a token with lease TTL → access only allowed paths. HA depends on storage backend and unseal procedures (Shamir or auto-unseal)—agents document patterns but never invent production unseal keys.

┌─────────────────────────────────────────────────────────────┐
│                 Vault request path                          │
│                                                             │
│  Auth (K8s / AppRole / OIDC / cloud)                        │
│       ↓ token + policies                                    │
│  Secret engines: KV v2, database, PKI, Transit              │
│       ↓ leases / versions                                   │
│  Audit devices → immutable log (no secret echo in chat)     │
└─────────────────────────────────────────────────────────────┘