Vault Associate Certification (Part 7): Utilize Vault UI
Tags: vault, hashicorp, security, learning
Published: 2023-09-11 13:30:09

Utilizing the Vault UI make up the seventh objective in the Vault certification journey. This objective covers the following sub-objectives:

- [Authenticate to Vault](#authenticate-to-vault)
- [Configure authentication methods](#configure-authentication-methods)
- [Configure Vault policies](#configure-vault-policies)
- [Enable Secret engines](#enable-secret-engines)
- [Access Vault secrets](#access-vault-secrets)

When you start a Vault development server (`vault server -dev`) the UI is enabled by default. However, this is not the case for _real_ Vault servers. We'll discuss this further in part nine of the series, for this part we'll stick to the development server. By default you can reach the UI on your development instance on `http://127.0.0.1:8200/ui/`.

## Authenticate to Vault

When you first enter the Vault UI you meet the following sign-in page:

![signin](https://assets.mattias.engineer/vault/07/signin.png)

In the drop-down you select the authentication method you would like to use to sign in. Note that the values in the drop-down might show more auth methods than what have been enabled on your Vault server.

Unless you first enable a few auth methods using the CLI your only option right now is to use the root token to sign in. Copy the root token from the terminal window where you started your Vault development server and paste it into the token input field, then click _Sign in_:

![signin](https://assets.mattias.engineer/vault/07/signin02.png)

Now you have successfully authenticated to Vault using the UI! The process is more or less the same for any of the other auth methods. You select the auth method you want to use, and you provide the required information to sign in. For some auth methods you will be re-directed to the auth methods own page and then re-directed back to Vault after successful authentication.

## Configure authentication methods

To configure a new auth method click on _Access_ in the main menu on the left. You come to a page showing all the currently enabled auth methods. If you are using a brand new development server you will only see the _token_ auth method in the list. To enable a new auth method click on _Enable new method_:

![auth](https://assets.mattias.engineer/vault/07/auth01.png)

You come to a page showing all the available auth methods that you can enable. For the purpose of this post we will enable the **userpass** auth method. Select **userpass** and then click _Next_:

![auth](https://assets.mattias.engineer/vault/07/auth02.png)

Now you have the option to specify which path the auth method should be enabled on. If you expand the _Method Options_ section you can also do advanced configuration of the auth method, this includes things such as specifying the default lease TTL, the max TTL, and more. We'll ignore the advanced configurations for now. Accept the default path and click on _Enable Method_:

![auth](https://assets.mattias.engineer/vault/07/auth03.png)

Once the method is enabled, click on _Go to method_. You come to a page listing all the users that are configured in the userpass auth method. Currently we have no user. To add a new user, click on _Create user_:

![auth](https://assets.mattias.engineer/vault/07/auth04.png)

Specify a username (I specify `bob`) and a password. Expand the _Tokens_ section to specify advanced settings for this user, such as which policies to attach to the tokens for this user. For now, let's ignore the advanced settings and click on _Save_:

![auth](https://assets.mattias.engineer/vault/07/auth05.png)

You can sign out of Vault and sign back in using the userpass method and your new user to verify that it works.

Configuring other auth methods follow the same basic steps, but the configuration for each method will differ. The best approach is to read the documentation for the auth method you want to enable to know what configuration options to provide.

## Configure Vault policies

To configure a new policy click on _Policies_ in the main menu on the left. You come to a page listing all the policies on the Vault server. If you are using a brand new development server this list will only contain the _default_ and _root_ policies. Note that you can't view the root policy, but you can view and even edit the default policy. Click on _Create ACL policy_ to create a new policy:

![auth](https://assets.mattias.engineer/vault/07/policy01.png)

On the _Create ACL policy_ page enter a name for your policy (I use `my-policy`) and enter the policy itself, then click on _Create policy_:

![auth](https://assets.mattias.engineer/vault/07/policy02.png)

Notice that you could upload a file instead of entering the policy directly on the page.

Now the policy is available for use in the rest of the Vault UI. If you need to edit or delete a policy go back to the policy page and open the policy you want to update/delete.

## Enable Secret engines

To configure a new secrets engine click on _Secrets engines_ in the main menu on the left. You come to a page listing all the currently enabled secrets engines. My list contains two secrets engines, _cubbyhole_ mounted on `cubbyhole/` and _key/value_ mounted on `secret/`. To add a new secrets engine click on _Enable new engine_:

![auth](https://assets.mattias.engineer/vault/07/secrets01.png)

Select the secrets engine you want to enable. For this demonstration I will use the key/value secrets engine. Select the engine and then click on _Next_:

![auth](https://assets.mattias.engineer/vault/07/secrets02.png)

Specify the path where you want to enable the secrets engine and then click _Enable engine_:

![auth](https://assets.mattias.engineer/vault/07/secrets03.png)

Note that you can expand the _Method Options_ section to reveal advanced settings for the secrets engine. For the key/value secrets engine part of these advanced settings look like the following image. This is where you could specify that you want version 1 of the key/value secrets engine instead of the (default) version 2:

![auth](https://assets.mattias.engineer/vault/07/secrets04.png)

Adding other secrets engines will follow the same pattern, but the various settings might differ between the different secrets engines.

## Access Vault secrets

Now let's continue the last section by adding secrets to our secrets engine. Go to the secrets engine page by clicking on _Secrets engines_ in the main menu on the left, then select the `kv/` secrets engine in the list. Click on _Create secret_ to add a new secret:

![auth](https://assets.mattias.engineer/vault/07/secrets05.png)

Provide a path for the secret and enter the secret data. I add my secret at the path of `database/password` and the secret data consists of `password=<my secret password>`. To create the secret click on _Save_:

![auth](https://assets.mattias.engineer/vault/07/secrets06.png)

Note that there was an option to add the secret data as JSON instead of adding them as key/value pairs in the UI.

If we want to read or update our secret we can find it by going back to the secrets engine page and click on `database/`:

![auth](https://assets.mattias.engineer/vault/07/secrets07.png)

Then click on `password`:

![auth](https://assets.mattias.engineer/vault/07/secrets08.png)

Finally we arrive at the page showing the secret:

![auth](https://assets.mattias.engineer/vault/07/secrets09.png)

We also see that we can create a new version of the secret, we can delete it, make a copy, view different versions, and more. Also note that there is a separate tab for _Metadata_.

Working with secrets using the other secrets engines follows similar patterns but will vary depending on the type of secrets engine.