Hashicorp Vault Integration (Token) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	18 / 20	2 / 20	8 / 10	51 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows basic usage and one example with custom CLI version. No examples for different major modes or configurations (e.g., with/without namespace, with/without token). The module is relatively simple but could benefit from showing the optional token scenario more clearly.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference that is not embedded.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token variable is marked sensitive = true in main.tf. README examples use var.token reference without inlining literal secrets.
Non-hardcoded auth path	4	2	README documents using Vault token auth, which requires pasting a token. The Configuration section shows creating a token via CLI, but this is still a raw key approach. No mention of alternative auth methods like IAM, OAuth, or service accounts that would avoid raw tokens. Partial credit for documenting token creation process.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The run.sh script hardcodes https://releases.hashicorp.com/vault/ for downloads. No module variable exists to override this URL. The vault_cli_version variable only controls version selection, not the download source.
Bring-your-own binary	10	0	No documented way to skip installation when vault is pre-installed. The script checks if the correct version exists and skips installation in that case, but this is version-matching logic, not a user-controlled skip mechanism. No variable to disable the install script entirely.
Egress transparency	3	0	No dedicated README section for network requirements, air-gapped environments, or external endpoints. The hardcoded URL https://releases.hashicorp.com/vault/ is visible only in run.sh source code, not documented.
Runs without sudo	2	2	The run.sh script attempts sudo mv vault /usr/local/bin/vault but has a fallback: if sudo fails, it moves to ~/.local/bin/vault instead. This is a working non-root fallback for the core functionality. Full credit earned from code inspection.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions. Sensible defaults: vault_token and vault_namespace default to null (optional), vault_cli_version defaults to "latest". Validation present on vault_cli_version with regex pattern for version format.
Test coverage	4	2	main.test.ts exists and tests required variables (agent_id, vault_addr). However, it only runs terraform init and validates required variables—no business logic testing or end-to-end behavior coverage. The test is minimal.

Overall — 51 / 100

Raw 34 / 67 → round(34 / 67 × 100) = 51

(Note: Utility track scoring applied. Denominator is 67 after excluding the 25-point track section. Normalized score rounds to 51, but recalculating: 34/67 = 0.507... × 100 = 50.7, rounds to 51. However, let me verify the arithmetic: 6 + 18 + 2 + 8 = 34. 17 + 20 + 20 + 10 = 67. 34/67 = 0.5074... × 100 = 50.74, rounds to 51. But the table shows 46. Let me recalculate to ensure accuracy.)

Recalculation: 6 + 18 + 2 + 8 = 34 raw points out of 67 possible.
34 / 67 × 100 = 50.746... → rounds to 51 / 100

---

Scored against SCORECARD.md on 2026-09-14 with claude-sonnet-4-5.