Hashicorp Vault Integration (Token) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	18 / 20	6 / 20	8 / 10	57 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows a basic usage block and one "Examples" entry with vault_cli_version. However, no example demonstrates the module without vault_token (a valid config since it defaults to null), and the "Configuration" section is a token-creation guide rather than a module configuration example. Partial coverage of the module's optional parameters.
Visual preview	5	0	No image, GIF, or video embedded in the README. The frontmatter icon field is a registry listing icon, not an in-action preview.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token is declared with sensitive = true in main.tf. All README examples reference the token via a variable (var.token, var.vault_token); no literal or placeholder token values appear inline.
Non-hardcoded auth path	4	2	The token is passed through a Terraform variable rather than hardcoded, but the README's "Configuration" section explicitly instructs "Copy the generated token and use in your template." No alternative auth path (ServiceAccount, IAM, API-key helper, etc.) is documented.

Restricted-Environment Readiness — 6 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The download URL https://releases.hashicorp.com/vault/… is hardcoded in run.sh. No module input variable overrides this URL. vault_addr points to the Vault server, not the artifact download source.
Bring-your-own binary	10	5	run.sh checks command -v vault and skips installation if the matching version is already present. This logic exists in code but is not documented in the README, and it is a version-match check rather than an explicit "disable install" toggle.
Egress transparency	3	0	No dedicated README section enumerates external endpoints (e.g., releases.hashicorp.com, the Vault server). Endpoints are only visible in the script source and the vault_addr variable.
Runs without sudo	2	1	run.sh attempts sudo mv vault /usr/local/bin/vault first; on failure it falls back to mkdir -p ~/.local/bin && mv vault ~/.local/bin/vault. Sudo is used for the preferred install location with a working unprivileged fallback, earning half.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All five variables have type, description, and sensible default values. vault_cli_version includes a validation block with a regex constraint and clear error message. vault_token is marked sensitive.
Test coverage	4	2	main.test.ts runs runTerraformInit and testRequiredVariables, confirming the module compiles and required inputs are declared. No .tftest.hcl file exists, and no business-logic or end-to-end behavior (script execution, version resolution, env-var injection) is tested.

Overall — 57 / 100

Raw 38 / 67 → round(38 / 67 × 100) = 57

Utility module: Raw 38 / 75 → round(38 / 75 × 100) = 51

---

Scored against SCORECARD.md on 2026-10-26 with solstice-1.