Hashicorp Vault Integration (Token) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	7 / 20	8 / 10	61 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	Two examples shown (basic integration and with specific CLI version), but no coverage of major configuration modes like with/without namespace, with/without token variable. Examples are minimal.
Coder-context framing	8	7	Explains what the module adds (Vault authentication in Coder workspaces), names both Coder and Vault, shows usage in workspaces. Minor: doesn't explicitly show where Coder fits in the broader Vault workflow.
Visual preview	5	0	No image, GIF, or video. Only an icon reference in frontmatter.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	14	vault_token variable is marked sensitive = true in main.tf. README examples show vault_token = var.token which references a variable, but the variable declaration itself shows sensitive = true inline in the example, which is good practice. Minor deduction: the variable name inconsistency (var.token vs vault_token) could cause confusion.
Non-hardcoded auth path	4	4	README documents creating a Vault token with appropriate policies, which is the standard Vault auth path. Shows policy creation and token generation commands.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The download URL https://releases.hashicorp.com/vault/... is hardcoded in run.sh. No module input variable exists to override this URL.
Bring-your-own binary	5	0	No documented way to skip installation when vault is pre-installed. The script checks if the correct version exists but always attempts installation/upgrade if versions don't match. No variable to disable the install entirely.
Egress transparency	3	1.5	Endpoints are visible in code (https://releases.hashicorp.com/vault/ and https://releases.hashicorp.com/vault/[version]/vault_[version]_linux_[arch].zip) and in examples (https://vault.example.com), but no dedicated README section for restricted environments. Scattered mentions only.
Runs without sudo	2	2	Script attempts sudo mv vault /usr/local/bin/vault but has explicit fallback: mkdir -p ~/.local/bin and mv vault ~/.local/bin/vault with a message about adding to PATH. Core functionality works without sudo.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Variables have descriptions. vault_cli_version has validation with regex. Defaults are present (null for optional vars, "latest" for version). However, vault_token default is null but no description of behavior when omitted; vault_addr has no validation despite being a URL.
Test coverage	4	4	TypeScript test in main.test.ts covers required variables (agent_id, vault_addr). Tests run terraform init and validate required inputs. Business logic is minimal (env var setting), appropriately tested.

Overall — 61 / 100

Raw 46 / 75 → round(46 / 75 × 100) = 61

Note: This is a Utility module (Vault integration/authentication helper), so scored on Universal criteria only (75 pts) then normalized to 100. Actual calculation: 46 / 75 = 0.6133... → rounds to 61, but rechecking arithmetic: 13 + 18 + 7 + 8 = 46. 46/75 × 100 = 61.33 → 62 (standard rounding).

---

Scored against SCORECARD.md on 2026-08-03 with claude-sonnet-4-5.