> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# HashiCorp Vault
> Connect Vault to Iru Compliance with a client token and least-privilege policy for mounts, policies, and audit configuration evidence.
### About HashiCorp Vault
Iru reads **secrets engine mounts**, **auth method configuration**, **named policies**, **audit devices**, and related **sys/** metadata using the Vault HTTP API. Each request sends your **client token** in **`X-Vault-Token`**. Iru collects **configuration evidence** - not **secret plaintext** values.
Works with **Vault OSS**, **Enterprise** (namespaces may need extra setup), and **HCP Vault**.
### How It Works
```http theme={null}
X-Vault-Token: hvs.xxxxxxxx
```
Tokens come from any Vault **auth method** (Token, AppRole, LDAP, etc.). The wizard first stores **`vault_addr`** (for example `https://vault.example.com:8200`), then accepts the token.
| Detail | Value |
| ------------------ | ------------------------------ |
| **Category** | Secrets management |
| **Authentication** | Client token (`X-Vault-Token`) |
Official references: [Auth concepts](https://developer.hashicorp.com/vault/docs/concepts/auth), [HTTP API](https://developer.hashicorp.com/vault/api-docs), [Policies](https://developer.hashicorp.com/vault/docs/concepts/policies), [AppRole](https://developer.hashicorp.com/vault/docs/auth/approle).
### Prerequisites
* A Vault cluster **reachable from Iru** (network / firewall / PrivateLink as applicable).
* Permission to create a **policy** and **token** (or AppRole) with read-only **`sys/`** access as in the example below.
### Example Read-Only Policy (HCL)
Save as a `.hcl` file and apply with **`vault policy write iru-compliance your-file.hcl`**.
```hcl lines theme={null}
path "sys/mounts" {
capabilities = ["read", "list"]
}
path "sys/auth" {
capabilities = ["read", "list"]
}
path "sys/policy" {
capabilities = ["read", "list"]
}
path "sys/policies/acl/*" {
capabilities = ["read", "list"]
}
path "sys/audit" {
capabilities = ["read", "list"]
}
path "auth/token/lookup-self" {
capabilities = ["read"]
}
```
### Connect HashiCorp Vault to Iru
#### Apply the policy and issue a token
Use a jump host or admin workstation that can reach **`VAULT_ADDR`** over TLS and has the **Vault CLI** installed (`vault` binary).
Sign in with your org’s supported method (**`vault login`**, OIDC, etc.) so subsequent commands run with enough privilege to write policies and create tokens.
Save the example policy from above as an `.hcl` file on that machine (for example `iru-compliance.hcl`).
Run **`vault policy write iru-compliance`** with your policy file path.
Create a **renewable** token bound to that policy (for example **`vault token create -policy=iru-compliance -ttl=720h -renewable=true`**). Copy the **`hvs.`** token value.
For production, prefer **AppRole** or another automated flow instead of long-lived static tokens.
#### Complete the connector in Iru
In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.
Find **HashiCorp Vault** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
Enter **`vault_addr`** (for example `https://vault.example.com:8200`) and confirm server variables when prompted.
Paste the token into the **`X-Vault-Token`** field when prompted.
Click **Submit API Key**. When the connection succeeds, the wizard shows **Connection Configured**.
Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **HashiCorp Vault** card is **Active**.
### Troubleshooting
Check **pop-up blocker** settings for the Iru site and try again.
Refresh the wizard by toggling the source; re-enter **`vault_addr`**.
Attach **`iru-compliance`** policy to the token; check **Enterprise namespaces**.
Issue a new token and update Iru; enable **renewal** or use AppRole rotation.
Hostname, port (**8200**), TLS, and outbound routes from Iru.
**Unseal** Vault before testing.
### Considerations
Vault **Enterprise** **namespaces** may require paths or settings beyond this baseline - coordinate with your Vault admins.
### Related Articles
Browse and manage every Compliance source.
Frameworks, actions, and **Artifacts**.
How Endpoint, Compliance, and Identity fit together.
Upload, review, and organize evidence from sources and actions.