Skip to content

vault-secrets.md

Latest commit

 

History

History
117 lines (80 loc) · 2.41 KB

vault-secrets.md

File metadata and controls

117 lines (80 loc) · 2.41 KB

Securing Secrets with Vault

Store and manage secrets using Neumann's encrypted vault. By the end you will have secrets stored with AES-256-GCM encryption and graph-based access control.

Prerequisites

Step 1: Start the Shell

neumann --wal-dir ./vault-data

Step 2: Store a Secret

Store an API key as an encrypted secret:

VAULT PUT 'api-keys/openai' 'sk-proj-abc123def456'

Verify it was stored:

VAULT GET 'api-keys/openai'

You should see the decrypted value sk-proj-abc123def456.

Step 3: Store More Secrets

VAULT PUT 'api-keys/stripe' 'sk_live_xyz789'
VAULT PUT 'database/production/password' 'super-secret-db-pass'
VAULT PUT 'certificates/tls-key' '-----BEGIN PRIVATE KEY-----...'

Step 4: List Secrets

VAULT LIST 'api-keys/'

You should see api-keys/openai and api-keys/stripe.

Step 5: Set Up Access Control

Create access policies using the graph engine. Define roles and permissions:

NODE CREATE role { name: 'developer' }
NODE CREATE role { name: 'ops' }
NODE CREATE secret_group { name: 'api-keys' }
NODE CREATE secret_group { name: 'database' }

Connect roles to secret groups:

EDGE CREATE 'node:1' -> 'node:3' : can_read
EDGE CREATE 'node:2' -> 'node:3' : can_read
EDGE CREATE 'node:2' -> 'node:4' : can_read
EDGE CREATE 'node:2' -> 'node:4' : can_write

This gives:

  • Developers: read access to API keys
  • Ops: read access to API keys, read+write access to database secrets

Step 6: Update a Secret

VAULT PUT 'api-keys/openai' 'sk-proj-new-key-789'

The old value is replaced. Retrieve to confirm:

VAULT GET 'api-keys/openai'

Step 7: Delete a Secret

VAULT DELETE 'api-keys/stripe'

Verify it was removed:

VAULT GET 'api-keys/stripe'

This should return an error indicating the secret was not found.

Verification

You should have:

  • Secrets stored with encryption (VAULT PUT/GET working)
  • Hierarchical secret paths (api-keys/, database/)
  • Graph-based access control nodes and edges
  • Secret update and deletion working

Next Steps