HashiCorp Vault cheatsheet

Environment

export VAULT_ADDR='https://vault.example.com:8200'
export VAULT_TOKEN='hvs....'   # or use vault login
export VAULT_SKIP_VERIFY=true  # dev only — self-signed TLS

Status, seal, unseal

Command	Description
`vault status`	Sealed? HA mode? version
`vault operator init`	First-time init (once per cluster)
`vault operator unseal`	Enter unseal key shard (repeat until threshold)
`vault operator seal`	Seal Vault (emergency / maintenance)
`vault login`	Authenticate (token or method)

KV secrets (v2)

Command	Description
`vault secrets enable -path=secret kv-v2`	Enable KV v2 at secret/
`vault kv put secret/myapp password=secret db=user:pass`	Write secret
`vault kv get secret/myapp`	Read secret
`vault kv list secret/`	List keys under path
`vault kv metadata get secret/myapp`	Versions, created time

Policies and auth

vault policy write myapp - <<EOF
path "secret/data/myapp/*" {
  capabilities = ["read", "list"]
}
EOF

vault auth enable approle
vault read auth/token/lookup-self
vault token capabilities secret/data/myapp/config

Engines and mounts

Command	Description
`vault secrets list`	Enabled secret engines
`vault auth list`	Enabled auth methods
`vault read sys/health`	Health endpoint (HTTP)
`vault audit list`	Audit devices

Tokens and leases

Command	Description
`vault token lookup`	Current token metadata
`vault token renew`	Extend token TTL
`vault lease renew secret/data/myapp`	Renew secret lease
`vault token revoke TOKEN`	Invalidate token

Operator / HA

vault operator raft list-peers
vault operator raft snapshot save backup.snap
vault operator migrate -config=migrate.hcl   # storage migration

curl -s $VAULT_ADDR/v1/sys/health | jq .

Health HTTP codes

Code	Meaning
`200`	Initialized, unsealed, active
`429`	Unsealed but standby (not active node)
`472`	Disaster recovery replication secondary
`501`	Not initialized
`503`	Sealed

Pro tips

vault status first — sealed Vault explains most total outages
KV v2 read path is secret/data/...; v1 is secret/...
Use limited policies — never give apps the root token
Enable audit logs before production — essential for forensics
Raft snapshot backups need unseal keys (or auto-unseal) to restore

Practice scenarios

Hands-on HashiCorp Vault scenarios on live Linux VMs: hashicorp vault