About HashiCorp Vault
Iru reads secrets engine mounts, auth method configuration, named policies, audit devices, and related sys/ metadata using the Vault HTTP API. Each request sends your client token inX-Vault-Token. Iru collects configuration evidence - not secret plaintext values.
Works with Vault OSS, Enterprise (namespaces may need extra setup), and HCP Vault.
How It Works
vault_addr (for example https://vault.example.com:8200), then accepts the token.
Official references: Auth concepts, HTTP API, Policies, AppRole.
Prerequisites
- A Vault cluster reachable from Iru (network / firewall / PrivateLink as applicable).
- Permission to create a policy and token (or AppRole) with read-only
sys/access as in the example below.
Example Read-Only Policy (HCL)
Save as a.hcl file and apply with vault policy write iru-compliance your-file.hcl.
Connect HashiCorp Vault to Iru
Apply the policy and issue a token
1
Prepare a workstation with Vault CLI access
Use a jump host or admin workstation that can reach
VAULT_ADDR over TLS and has the Vault CLI installed (vault binary).2
Authenticate the CLI to Vault
Sign in with your org’s supported method (
vault login, OIDC, etc.) so subsequent commands run with enough privilege to write policies and create tokens.3
Write the policy file
Save the example policy from above as an
.hcl file on that machine (for example iru-compliance.hcl).4
Apply the policy in Vault
Run
vault policy write iru-compliance with your policy file path.5
Create a renewable token
Create a renewable token bound to that policy (for example
vault token create -policy=iru-compliance -ttl=720h -renewable=true). Copy the hvs. token value.6
Prefer AppRole for production
For production, prefer AppRole or another automated flow instead of long-lived static tokens.
Complete the connector in Iru
1
Open Sources
In Iru Compliance, on the left navigation bar, expand Compliance and select Sources.
2
Turn on HashiCorp Vault
Find HashiCorp Vault (use Category or Search by name or description). On that card, turn on the toggle. A browser tab or window may open for the connector wizard.
3
Configure server variables
Enter
vault_addr (for example https://vault.example.com:8200) and confirm server variables when prompted.4
Paste the Vault token
Paste the token into the
X-Vault-Token field when prompted.5
Finish the connection
Click Submit API Key. When the connection succeeds, the wizard shows Connection Configured.
6
Confirm the source is Active
Close the Iru is requesting access to external services browser tab, then return to Compliance → Sources and confirm the HashiCorp Vault card is Active.
Troubleshooting
Nothing opens when you turn the source on
Nothing opens when you turn the source on
Check pop-up blocker settings for the Iru site and try again.
Server variables failed
Server variables failed
Refresh the wizard by toggling the source; re-enter
vault_addr.403 permission denied
403 permission denied
Attach
iru-compliance policy to the token; check Enterprise namespaces.Token expired
Token expired
Issue a new token and update Iru; enable renewal or use AppRole rotation.
Connection refused
Connection refused
Hostname, port (8200), TLS, and outbound routes from Iru.
503 sealed
503 sealed
Unseal Vault before testing.
Considerations
Vault Enterprise namespaces may require paths or…
Vault Enterprise namespaces may require paths or settings beyond this baseline - coordinate with your Vault admins.
Related Articles
Sources Management
Browse and manage every Compliance source.
Getting Started With Compliance
Frameworks, actions, and Artifacts.
Iru Overview
How Endpoint, Compliance, and Identity fit together.
Artifacts Management
Upload, review, and organize evidence from sources and actions.