• Overview
    • Automated PKI Infrastructure
    • Data Encryption & Tokenization
    • Database Credential Rotation
    • Dynamic Secrets
    • Identity-based Access
    • Key Management
    • Kubernetes Secrets
    • Secrets Management
  • Enterprise
  • Tutorials
  • Docs
  • API
  • Community
GitHubTry Cloud
Download
    • v1.11.x (latest)
    • v1.10.x
    • v1.9.x
    • v1.8.x
    • v1.7.x
    • v1.6.x
    • v1.5.x
    • v1.4.x
  • What is Vault?
  • Use Cases
    • CLI Quick Start
    • HCP Quick Start
    • Developer Quick Start

  • Browser Support
  • Installing Vault
    • Overview
    • Architecture
    • High Availability
    • Integrated Storage
    • Security Model
    • Telemetry
    • Token Authentication
    • Key Rotation
    • Replication
    • Limits and Maximums
    • Overview
    • 'Dev' Server
    • Seal/Unseal
    • Namespace API Lock
    • Lease, Renew, and Revoke
    • Authentication
    • Tokens
    • Identity
    • OIDC Provider
    • Response Wrapping
    • Policies
    • Password Policies
    • Username Templating
    • High Availability
    • Storage
      • Overview
      • Autopilot
    • PGP, GnuPG, and Keybase
    • Recovery Mode
    • Resource Quotas
      • Overview
      • FAQ
    • Transform
    • Mount Migration
    • Overview
      • Overview
      • TCP
    • replication
      • Overview
      • AliCloud KMS
      • AWS KMS
      • Azure Key Vault
      • GCP Cloud KMS
      • OCI KMS
      • HSM PKCS11 ENT
      • Vault Transit
    • sentinel
      • Overview
      • Consul
      • Kubernetes
      • Overview
      • Aerospike
      • Alicloud OSS
      • Azure
      • Cassandra
      • CockroachDB
      • Consul
      • CouchDB
      • DynamoDB
      • Etcd
      • Filesystem
      • FoundationDB
      • Google Cloud Spanner
      • Google Cloud Storage
      • In-Memory
      • Manta
      • MSSQL
      • MySQL
      • OCI Object Storage
      • PostgreSQL
      • Integrated Storage (Raft)
      • S3
      • Swift
      • Zookeeper
    • telemetry
    • ui
    • Log Completed Requests
    • Entropy Augmentation ENT
    • kms_library ENT
    • Overview
    • agent
      • Overview
      • disable
      • enable
      • list
      • Overview
      • disable
      • enable
      • help
      • list
      • move
      • tune
    • debug
    • delete
      • Overview
      • delete
      • destroy
      • enable-versioning
      • get
      • list
      • metadata
      • patch
      • put
      • rollback
      • undelete
      • Overview
      • lookup
      • renew
      • revoke
      • Overview
      • get
      • inspect
    • list
    • login
    • monitor
    • namespace
      • Overview
      • diagnose
      • generate-root
      • init
      • key-status
      • members
      • migrate
      • raft
      • rekey
      • rotate
      • seal
      • step-down
      • unseal
      • usage
    • path-help
      • Overview
      • deregister
      • info
      • list
      • register
      • reload
      • Overview
      • delete
      • fmt
      • list
      • read
      • write
    • read
      • Overview
      • disable
      • enable
      • list
      • move
      • tune
    • server
    • ssh
    • status
      • Overview
      • capabilities
      • create
      • lookup
      • renew
      • revoke
    • unwrap
    • version
    • version-history
    • write
    • Token Helpers
    • Overview
      • Overview
        • Overview
        • AliCloud
        • AppRole
        • AWS
        • Azure
        • Cert
        • CF
        • GCP
        • JWT
        • Kerberos
        • Kubernetes
        • Overview
        • File
      • Overview
        • Overview
        • Kubernetes
    • Templates
    • Windows service

    • Overview
    • Active Directory
    • AliCloud
    • AWS
    • Azure
    • Consul
    • Cubbyhole
      • Overview
      • Cassandra
      • Couchbase
      • Elasticsearch
      • HanaDB
      • IBM Db2
      • InfluxDB
      • MongoDB
      • MongoDB Atlas
      • MSSQL
      • MySQL/MariaDB
      • Oracle
      • PostgreSQL
      • Redshift
      • Snowflake
      • Custom
    • Google Cloud
    • Google Cloud KMS
      • Overview
      • Identity Tokens
      • OIDC Identity Provider
      • Overview
      • Azure Key Vault
      • AWS KMS
      • GCP Cloud KMS
      • Overview
      • K/V Version 1
      • K/V Version 2
    • KMIP ENTERPRISE
    • Kubernetes
    • MongoDB Atlas
    • Nomad
    • OpenLDAP
      • Overview
      • Setup and Usage
      • Quick Start - Root CA Setup
      • Quick Start - Intermediate CA Setup
      • Considerations
      • Rotation Primitives
    • RabbitMQ
      • Overview
      • Signed Certificates
      • SSH OTP
      • Dynamic Key
    • Terraform Cloud
    • TOTP
      • Overview
      • FF3-1 Tweak Usage
      • Tokenization Transform ENTERPRISE
    • Transit
    • Venafi (Certificates)
    • Overview
    • AppRole
    • AliCloud
    • AWS
    • Azure
    • Cloud Foundry
    • GitHub
    • Google Cloud
      • Overview
      • OIDC Providers
    • Kerberos
    • Kubernetes
    • LDAP
      • Overview
      • FAQ
    • Oracle Cloud Infrastructure
    • Okta
    • RADIUS
    • TLS Certificates
    • Tokens
    • Username & Password

    • App ID DEPRECATED
    • Overview
    • File
    • Syslog
    • Socket
    • Overview
    • Plugin Architecture
    • Plugin Development
    • Plugin Management
    • Plugin Portal
  • Vault Integration Program
  • Troubleshoot

    • Overview
      • Overview
      • Agent Injector vs. Vault CSI Provider
        • Overview
        • Running Vault
        • Enterprise Licensing
        • Running Vault on OpenShift
        • Configuration
          • Overview
          • Development
          • Standalone with Load Balanced UI
          • Standalone with TLS
          • Standalone with Audit Storage
          • External Vault
          • Using Kubernetes Auth Method
          • HA Cluster with Consul
          • HA Cluster with Raft
          • HA Enterprise Cluster with Raft
          • HA Enterprise DR Clusters with Raft
          • HA Enterprise Performance Clusters with Raft
          • Vault Agent Injector TLS Configuration
          • Vault Agent Injector TLS with Cert-Manager
        • Overview
        • Annotations
        • Installation
        • Examples
        • Overview
        • Installation
        • Configurations
        • Examples
      • Overview
      • Vault Lambda Extension
      • Running Vault
      • Overview
      • Installation
      • Configuration
      • Troubleshooting
      • Overview
      • Installation
      • Configuration
      • Upgrading
      • Troubleshooting

    • Overview
    • Upgrade Plugins
    • Upgrade to 1.11.x
    • Upgrade to 1.10.x
    • Upgrade to 1.9.x
    • Upgrade to 1.8.x
    • Upgrade to 1.7.x
    • Upgrade to 1.6.3
    • Upgrade to 1.6.2
    • Upgrade to 1.6.1
    • Upgrade to 1.6.0
    • Upgrade to 1.5.3
    • Upgrade to 1.5.2
    • Upgrade to 1.5.1
    • Upgrade to 1.5.0
    • Upgrade to 1.4.6
    • Upgrade to 1.4.5
    • Upgrade to 1.4.4
    • Upgrade to 1.4.1
    • Upgrade to 1.4.0
    • Upgrade to 1.3.10
    • Upgrade to 1.3.9
    • Upgrade to 1.3.8
    • Upgrade to 1.3.5
    • Upgrade to 1.3.4
    • Upgrade to 1.3.3
    • Upgrade to 1.3.2
    • Upgrade to 1.3.0
    • Upgrade to 1.2.7
    • Upgrade to 1.2.6
    • Upgrade to 1.2.5
    • Upgrade to 1.2.4
    • Upgrade to 1.2.1
    • Upgrade to 1.2.0
    • Upgrade to 1.1.2
    • Upgrade to 1.1.1
    • Upgrade to 1.1.0
    • Upgrade to 1.0.0
    • Upgrade to 0.11.6
    • Upgrade to 0.11.2
    • Upgrade to 0.11.0
    • Upgrade to 0.10.4
    • Upgrade to 0.10.2
    • Upgrade to 0.10.0
    • Upgrade to 0.9.6
    • Upgrade to 0.9.3
    • Upgrade to 0.9.2
    • Upgrade to 0.9.1
    • Upgrade to 0.9.0
    • Upgrade to 0.8.0
    • Upgrade to 0.7.0
    • Upgrade to 0.6.4
    • Upgrade to 0.6.3
    • Upgrade to 0.6.2
    • Upgrade to 0.6.1
    • Upgrade to 0.6.0
    • Upgrade to 0.5.1
    • Upgrade to 0.5.0

    • Overview
    • 1.11.0
    • 1.10.0
    • 1.9.0
    • 1.8.0
    • 1.7.0
    • 1.6.0
    • 1.5.0

    • Overview
    • FAQ

    • Overview
    • Feature Deprecation Notice and Plans
    • License
    • Client Count
    • Login MFA
    • Server Side Consistent Token

  • Glossary

    • Overview
      • Overview
      • Autoloading
      • FAQ
    • Replication
      • Overview
      • Behavioral Changes
      • Security
    • Automated Integrated Storage Snapshots
    • Automated Upgrades
    • Redundancy Zones
    • Lease Count Quotas
    • Entropy Augmentation
      • Overview
      • FIPS 140-2 Inside Vault
      • Seal Wrap for FIPS 140-2
    • Seal Wrap
    • Namespaces
    • Performance Standbys
    • Eventual Consistency
    • Control Groups
    • Managed Keys
      • Overview
      • Duo MFA
      • Okta MFA
      • PingID MFA
      • TOTP MFA
      • Overview
      • Examples
      • Properties
    • HCP Vault

The Vault website is being redesigned to help you find what you are looking for more effectively.

Type '/' to Search

»Consul Storage Backend

The Consul storage backend is used to persist Vault's data in Consul's key-value store. In addition to providing durable storage, inclusion of this backend will also register Vault as a service in Consul with a default health check.

  • High Availability – the Consul storage backend supports high availability.

  • HashiCorp Supported – the Consul storage backend is officially supported by HashiCorp.

storage "consul" {
  address = "127.0.0.1:8500"
  path    = "vault"
}
storage "consul" {
  address = "127.0.0.1:8500"
  path    = "vault"
}

Once properly configured, an unsealed Vault installation should be available and accessible at:

active.vault.service.consul
active.vault.service.consul

Unsealed Vault instances in standby mode are available at:

standby.vault.service.consul
standby.vault.service.consul

All unsealed Vault instances are available as healthy at:

vault.service.consul
vault.service.consul

Sealed Vault instances will mark themselves as unhealthy to avoid being returned at Consul's service discovery layer.

Note that if you have configured multiple listeners for Vault, you must specify which one Consul should advertise to the cluster using api_addr and cluster_addr (example).

»consul Parameters

  • address (string: "127.0.0.1:8500") – Specifies the address of the Consul agent to communicate with. This can be an IP address, DNS record, or unix socket. It is recommended that you communicate with a local Consul agent; do not communicate directly with a server.

  • check_timeout (string: "5s") – Specifies the check interval used to send health check information back to Consul. This is specified using a label suffix like "30s" or "1h".

  • consistency_mode (string: "default") – Specifies the Consul consistency mode. Possible values are "default" or "strong".

  • disable_registration (string: "false") – Specifies whether Vault should register itself with Consul.

  • max_parallel (string: "128") – Specifies the maximum number of concurrent requests to Consul. Make sure that your Consul agents are configured to support this level of parallelism, see http_max_conns_per_client.

  • path (string: "vault/") – Specifies the path in Consul's key-value store where Vault data will be stored.

  • scheme (string: "http") – Specifies the scheme to use when communicating with Consul. This can be set to "http" or "https". It is highly recommended you communicate with Consul over https over non-local connections. When communicating over a unix socket, this option is ignored.

  • service (string: "vault") – Specifies the name of the service to register in Consul.

  • service_tags (string: "") – Specifies a comma-separated list of tags to attach to the service registration in Consul.

  • service_address (string: nil) – Specifies a service-specific address to set on the service registration in Consul. If unset, Vault will use what it knows to be the HA redirect address - which is usually desirable. Setting this parameter to "" will tell Consul to leverage the configuration of the node the service is registered on dynamically. This could be beneficial if you intend to leverage Consul's translate_wan_addrs parameter.

  • token (string: "") – Specifies the Consul ACL token with permission to read and write from the path in Consul's key-value store. This is not a Vault token. This can also be provided via the environment variable CONSUL_HTTP_TOKEN. See the ACL section below for help.

  • session_ttl (string: "15s") - Specifies the minimum allowed session TTL. Consul server has a lower limit of 10s on the session TTL by default. The value of session_ttl here cannot be lesser than 10s unless the session_ttl_min on the consul server's configuration has a lesser value.

  • lock_wait_time (string: "15s") - Specifies the wait time before a lock acquisition is made. This affects the minimum time it takes to cancel a lock acquisition.

The following settings apply when communicating with Consul via an encrypted connection. You can read more about encrypting Consul connections on the Consul encryption page.

  • tls_ca_file (string: "") – Specifies the path to the CA certificate used for Consul communication. This defaults to system bundle if not specified. This should be set according to the ca_file setting in Consul.

  • tls_cert_file (string: "") (optional) – Specifies the path to the certificate for Consul communication. This should be set according to the cert_file setting in Consul.

  • tls_key_file (string: "") – Specifies the path to the private key for Consul communication. This should be set according to the key_file setting in Consul.

  • tls_min_version (string: "tls12") – Specifies the minimum TLS version to use. Accepted values are "tls10", "tls11", "tls12" or "tls13".

  • tls_skip_verify (string: "false") – Disable verification of TLS certificates. Using this option is highly discouraged.

»ACLs

If using ACLs in Consul, you'll need appropriate permissions. For Consul 0.8, the following will work for most use-cases, assuming that your service name is vault and the prefix being used is vault/:

{
  "key": {
    "vault/": {
      "policy": "write"
    }
  },
  "service": {
    "vault": {
      "policy": "write"
    }
  },
  "agent": {
    "": {
      "policy": "read"
    }
  },
  "session": {
    "": {
      "policy": "write"
    }
  }
}
{
  "key": {
    "vault/": {
      "policy": "write"
    }
  },
  "service": {
    "vault": {
      "policy": "write"
    }
  },
  "agent": {
    "": {
      "policy": "read"
    }
  },
  "session": {
    "": {
      "policy": "write"
    }
  }
}

For Consul 1.4+, the following example takes into account the changed ACL language:

{
  "key_prefix": {
    "vault/": {
      "policy": "write"
    }
  },
  "service": {
    "vault": {
      "policy": "write"
    }
  },
  "agent_prefix": {
    "": {
      "policy": "read"
    }
  },
  "session_prefix": {
    "": {
      "policy": "write"
    }
  }
}
{
  "key_prefix": {
    "vault/": {
      "policy": "write"
    }
  },
  "service": {
    "vault": {
      "policy": "write"
    }
  },
  "agent_prefix": {
    "": {
      "policy": "read"
    }
  },
  "session_prefix": {
    "": {
      "policy": "write"
    }
  }
}

»consul Examples

»Local Agent

This example shows a sample physical backend configuration which communicates with a local Consul agent running on 127.0.0.1:8500.

storage "consul" {}
storage "consul" {}

»Detailed Customization

This example shows communicating with Consul on a custom address with an ACL token.

storage "consul" {
  address = "10.5.7.92:8194"
  token   = "abcd1234"
}
storage "consul" {
  address = "10.5.7.92:8194"
  token   = "abcd1234"
}

»Custom Storage Path

This example shows storing data at a custom path in Consul's key-value store. This path must be readable and writable by the Consul ACL token, if Consul configured to use ACLs.

storage "consul" {
  path = "vault/"
}
storage "consul" {
  path = "vault/"
}

»Consul via Unix Socket

This example shows communicating with Consul over a local unix socket.

storage "consul" {
  address = "unix:///tmp/.consul.http.sock"
}
storage "consul" {
  address = "unix:///tmp/.consul.http.sock"
}

»Custom TLS

This example shows using a custom CA, certificate, and key file to securely communicate with Consul over TLS.

storage "consul" {
  scheme        = "https"
  tls_ca_file   = "/etc/pem/vault.ca"
  tls_cert_file = "/etc/pem/vault.cert"
  tls_key_file  = "/etc/pem/vault.key"
}
storage "consul" {
  scheme        = "https"
  tls_ca_file   = "/etc/pem/vault.ca"
  tls_cert_file = "/etc/pem/vault.cert"
  tls_key_file  = "/etc/pem/vault.key"
}
github logoEdit this page
DocsAPILearnCommunityPrivacySecurityPress KitConsent Manager