Secrets import mappings
Vault supports multiple filter types for mapping blocks. Each of the types provides a different mechanism used to filter the scanned secrets and determine which will be imported in to Vault.
Argument reference
Refer to the HCL syntax for arguments common to all mapping types.
Passthrough mapping filters
The passthrough mapping block mapping_passthrough allows all secrets through from the specified source to the
specified destination. For example, one use case is setting it as a base-case for imported secrets. By assigning
it the lowest priority in the import plan, all other mapping blocks will be applied first. Secrets that fail
to match any of the previous mappings will fall through to the passthrough block and be collected in a single
KVv2 location.
Additional arguments
There are no extra arguments to specify in a mapping_passthrough block.
Example
In this example, every single secret that my-gcp-source-1 scans from GCP Secret Manager will be imported
to the KVv2 secrets engine mount defined in my-dest-1.
mapping_passthrough { name = "my-map-1" source = "my-gcp-source-1" destination = "my-dest-1" priority = 1}Metadata
The metadata mapping block mapping_metadata allows secrets through from the specified source to the specified
destination if they contain matching metadata key-value pairs. Metadata is not supported in all external secret
management systems, and ones that do may use different terminology for metadata. For example, AWS allows tags
on secrets while GCP allows labels.
Additional arguments
tags(string: <required>)- A set of key-value pairs to match on secrets from the external system. All of the specified keys must be found on a secret and all of the values must be exact matches. Specifying a key in this mapping with an empty value, i.e."", acts as a wildcard match to the external system's key's value.
Example
In this example, my-map-1 will only import the secrets into the destination my-dest-1 that contain a tag with
a key named importable and its value set to true.
mapping_metadata { name = "my-map-1" source = "my-gcp-source-1" destination = "my-dest-1" priority = 1 tags = { "importable" = "true" }}Regex
The regex mapping block mapping_regex allows secrets through from the specified source to the specified
destination if their secret name passes a regular expression check.
Additional arguments
expression(string: <required>)- The regular expression used to match secrets' names from the external system.
Example
In this example, any secret in the GCP source whose name begins with database/ will be imported into Vault.
mapping_regex { name = "my-map-1" source = "my-gcp-source-1" destination = "my-dest-1" priority = 1 expression = "^database/.*$"}Priority
Priority works in a "first match" fashion where lower values are higher priority. To explain in more detail, consider the above metadata example with a second additional mapping.
Below are two metadata mappings. The first, my-map-1, has a priority of 1. This will only import the secrets
into the destination my-dest-1 that contain both tag keys database and importable. Each of these keys' values
must also match to users and true respectively. The second, my-map-2, has a priority of 2. Even though all
the secrets in the first mapping would also qualify for the second mapping's filtering rule, those secrets will only
be imported into my-dest-1 because of my-map-2's lower priority. All remaining secrets that have the tag
importable with a value of true will be imported into my-dest-2.
mapping_metadata { name = "my-map-1" source = "my-gcp-source-1" destination = "my-dest-1" priority = 1 tags = { "database" = "users" "importable" = "true" }}mapping_metadata { name = "my-map-2" source = "my-gcp-source-1" destination = "my-dest-2" priority = 2 tags = { "importable" = "true" }}