Hashicorp Vault Integration (Token) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	7.5 / 20	8 / 10	62 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	Two examples shown: basic integration and version-specific installation. However, the basic example has a typo (vault_token = var.token should be var.vault_token), and neither example demonstrates the optional token-less mode (when vault_token is null). Partial coverage of major modes.
Coder-context framing	8	7	README explains this is for authenticating with Vault in Coder workspaces, names both Coder and Vault, and shows usage within workspaces. Minor: could be clearer about where Coder fits in the Vault authentication flow.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	14	The vault_token variable is marked sensitive = true in main.tf. However, README examples show vault_token = var.token which could be interpreted as encouraging inline usage, though the variable declaration example does show sensitive = true. Slight ambiguity in guidance.
Non-hardcoded auth path	4	4	README documents creating a Vault token with appropriate policies, which is a standard Vault authentication pattern. Shows proper token creation workflow.

Restricted-Environment Readiness — 7.5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The download URL https://releases.hashicorp.com/vault/... is hardcoded in run.sh. No module variable exists to override this URL. The vault_cli_version variable only controls the version number, not the source URL.
Bring-your-own binary	5	2.5	The script checks if vault is already installed with the correct version and skips installation if so. However, this is not explicitly documented in the README as a bring-your-own-binary strategy. Partial credit for the implementation without documentation.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The HashiCorp releases URL is visible only in source code (run.sh). Endpoints are inferable but not documented.
Runs without sudo	2	2	The run.sh script attempts sudo mv first, then falls back to ~/.local/bin if sudo fails, with a message to add to PATH. This is a working non-root fallback for the core functionality.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions and sensible defaults. The vault_cli_version includes validation with a regex pattern for version format. vault_token properly defaults to null for optional usage.
Test coverage	4	2	TypeScript test exists (main.test.ts) but only tests required variables, not business logic. No .tftest.hcl file present. Minimal coverage.

Overall — 62 / 100

Raw 46.5 / 75 → round(46.5 / 75 × 100) = 62

Track: Utility (Vault integration/authentication helper)

---

Scored against SCORECARD.md on 2026-08-17 with claude-sonnet-4-5.