Vault CLI module

[bpmct]

A discussion dedicated to the Vault CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	7 / 20	10 / 10	64 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: basic CLI-only installation, with token authentication, custom version, custom install directory, with namespace (Enterprise), and Enterprise binary. Each has sensible defaults.
Coder-context framing	8	1	README mentions "Coder agent" in variable descriptions but does not explain what the module adds on top of Coder or show where Coder fits in the Vault workflow. No framing of how this integrates Vault with Coder workspaces.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference in frontmatter.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token variable is marked sensitive = true in main.tf. README examples use var.vault_token rather than inline secrets.
Non-hardcoded auth path	4	2	README shows token-based authentication via variable. No documentation of alternative paths like Vault's native OIDC/JWT, AppRole, or integration with external auth that would avoid pasting tokens. Related modules (vault-github, vault-jwt) are mentioned but this module itself only documents token auth.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the download URL. The script hardcodes HashiCorp API endpoints and releases.hashicorp.com URLs. Version selection does not constitute URL override.
Bring-your-own binary	5	0	No documented way to skip installation when vault is already in the image. The script always attempts installation/version check.
Egress transparency	3	1.5	External endpoints are visible in run.sh (api.releases.hashicorp.com, releases.hashicorp.com) and README Prerequisites mentions HTTP client requirements, but no dedicated section enumerates endpoints for restricted environments. Scattered mentions across code earn at most half.
Runs without sudo	2	2	Script attempts non-sudo installation first, falls back to sudo only when INSTALL_DIR is not writable, and has a working fallback to ~/.local/bin when sudo fails. Core functionality works without sudo.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (install_dir="/usr/local/bin", vault_cli_version="latest", enterprise=false). Validation present for vault_cli_version with regex checking semver format and rejecting v-prefix.
Test coverage	4	4	Comprehensive .tftest.hcl with 10 test runs covering: without token, with token, custom version, custom install dir, invalid version, valid semver, v-prefix rejection, namespace, token+namespace, and enterprise flag. Tests cover business logic thoroughly.

Overall — 64 / 100

Raw 48 / 75 → round(48 / 75 × 100) = 64 → 64 / 100

Utility module normalized: round(48 / 75 × 100) = 64

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.