Hashicorp Vault Integration (Token) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	16 / 20	1 / 20	8 / 10	46 / 100

Drilldown

Track: Utility (auth/integration module; no Agent/IDE elements)

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6 (half)	Module exposes only one real auth mode (static token). README shows the core example plus a "specific Vault CLI version" variant, but no coverage of other configuration paths (e.g., namespace usage isn't separately exemplified beyond inline mention). Thin but not absent.
Visual preview	5	0	No image, GIF, or video in README — only an icon reference.

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16 (full)	vault_token variable declared sensitive = true in both main.tf and the README's own variable "vault_token" block; examples reference var.token/var.vault_token, no literal key values inlined.
Non-hardcoded auth path	4	0	Module is inherently token-based; no documented ServiceAccount/IAM/OAuth alternative to passing a raw Vault token.

Restricted-Environment Readiness — 1 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh hardcodes https://releases.hashicorp.com/vault/... for both version discovery and binary download; no module variable overrides this URL.
Bring-your-own binary	10	0	Script checks for an existing matching vault binary and skips reinstall, but there is no documented variable/flag to explicitly disable install entirely when baked into the image.
Egress transparency	3	0	No dedicated network/egress/air-gapped section in README; releases.hashicorp.com endpoint is only visible in script source, not documented.
Runs without sudo	2	1 (half)	install() tries sudo mv vault /usr/local/bin/vault but falls back to ~/.local/bin if sudo fails — optional sudo with working fallback.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6 (full)	All variables have clear descriptions and sensible defaults (null/"latest"); vault_cli_version has a regex validation block.
Test coverage	4	2 (half)	main.test.ts only runs terraform init and testRequiredVariables smoke test; no .tftest.hcl or logic/behavior assertions (e.g., env var wiring, namespace handling).

Overall — 46 / 100

Raw 31 / 67 → round(31 / 67 × 100) = 46

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.