HashiCorp Vault — Enabling Engines

2 minute read

Secrets engines must be explicitly enabled before use. Each engine is mounted at a unique path and operates as an isolated namespace within Vault.

Enable a Secrets Engine

# Enable KV v2 at "secret/" (default path)
vault secrets enable kv-v2

# Enable at a custom path
vault secrets enable -path=team-a kv-v2

# Enable with a description
vault secrets enable -path=payments -description="Payment service secrets" kv-v2

Expected output:

Success! Enabled the kv-v2 secrets engine at: team-a/

List Enabled Engines

vault secrets list

Expected output:

Path          Type         Accessor              Description
----          ----         --------              -----------
cubbyhole/    cubbyhole    cubbyhole_abc123      per-token private secret storage
identity/     identity     identity_abc123       identity store
payments/     kv           kv_xyz789             Payment service secrets
secret/       kv           kv_ghi789             key/value secret storage
sys/          system       system_jkl012         system endpoints
team-a/       kv           kv_def456             n/a

# Detailed JSON output
vault secrets list -format=json | jq

Available Engine Types

Engine Type String Purpose
KV v1 kv (version=1) Simple key-value storage
KV v2 kv-v2 or kv (version=2) Versioned key-value storage
Database database Dynamic database credentials
Transit transit Encryption as a Service
PKI pki Certificate Authority
AWS aws Dynamic AWS IAM credentials
Azure azure Dynamic Azure credentials
GCP gcp Dynamic GCP credentials
SSH ssh SSH certificate signing
TOTP totp Time-based one-time passwords
Cubbyhole cubbyhole Per-token private storage 
# Enable various engines
vault secrets enable database
vault secrets enable transit
vault secrets enable pki
vault secrets enable -path=aws-prod aws

Disable a Secrets Engine

⚠️ Warning: Disabling an engine permanently deletes all data at that mount path.

# Disable an engine
vault secrets disable team-a/

Expected output:

Success! Disabled the secrets engine (if it existed) at: team-a/

Tune Engine Configuration

Adjust engine settings without disabling and re-enabling:

# Set default TTL and max TTL
vault secrets tune -default-lease-ttl=1h -max-lease-ttl=24h database/

# Set description
vault secrets tune -description="Production database secrets" database/

# Set max versions for KV v2
vault secrets tune -options=max_versions=10 secret/

# View current configuration
vault read sys/mounts/secret

API equivalent:

curl --header "X-Vault-Token: $VAULT_TOKEN" \
     --request POST \
     --data '{"default_lease_ttl": "3600", "max_lease_ttl": "86400"}' \
     "$VAULT_ADDR/v1/sys/mounts/database/tune"

Move (Remount) an Engine

Move an engine to a different path without losing data:

# Move from "secret/" to "kv/"
vault secrets move secret/ kv/

# Verify
vault secrets list

💡 Note: Remounting changes the path but preserves all data. Update any policies and applications that reference the old path.

Multiple Mounts of the Same Type

You can enable the same engine type at multiple paths:

# Multiple KV engines for different teams
vault secrets enable -path=team-alpha kv-v2
vault secrets enable -path=team-beta kv-v2
vault secrets enable -path=team-gamma kv-v2

# Multiple database engines for different environments
vault secrets enable -path=db-dev database
vault secrets enable -path=db-staging database
vault secrets enable -path=db-prod database

Each mount is completely isolated — team-alpha/myapp and team-beta/myapp are separate secrets.

Quick Reference

Command Description
vault secrets enable <type> Enable at default path
vault secrets enable -path=<path> <type> Enable at custom path
vault secrets list List all engines
vault secrets disable <path>/ Disable (destroys data!)
vault secrets tune -default-lease-ttl=1h <path>/ Tune settings
vault secrets move <old>/ <new>/ Move to new path
vault read sys/mounts/<path> View mount config

Next: Paths & Mount Points

You may also enjoy