Hashicorp Vault Integration (Token) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	16 / 20	6 / 20	8 / 10	54 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	Only two near-identical examples (basic token auth + version pinning). No distinct "modes" (e.g., no-token path, namespace-specific flow) are separately illustrated despite the module exposing several optional vars.
Visual preview	5	0	README contains only an icon reference (../../../../.icons/vault.svg); no screenshot, GIF, or video.

Credential Hygiene — 16 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token is declared sensitive = true in main.tf, and the README example assigns it via var.token/var.vault_token reference rather than an inline literal.
Non-hardcoded auth path	4	0	The module's entire purpose is raw Vault-token authentication; no alternative (OIDC, AppRole, ServiceAccount, AI Gateway, etc.) is documented or offered.

Restricted-Environment Readiness — 6 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh fetches from a hardcoded https://releases.hashicorp.com/vault/... URL; no module variable (e.g., a vault_cli_url or mirror override) replaces this download path.
Bring-your-own binary	10	5	install() silently skips download if an existing vault binary already matches vault_cli_version, but this behavior is undocumented and not exposed as a configurable "skip install" option in the README.
Egress transparency	3	0	No dedicated network/offline section; the only external endpoint (releases.hashicorp.com) is visible solely in source, not documented.
Runs without sudo	2	1	Script attempts sudo mv vault /usr/local/bin/vault but gracefully falls back to ~/.local/bin if sudo is unavailable — optional privileged path with a working non-root fallback.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions and sensible defaults (null for optional token/namespace, "latest" for version); vault_cli_version has a regex validation block.
Test coverage	4	2	main.test.ts only runs terraform init and testRequiredVariables; no .tftest.hcl for business logic and no end-to-end TypeScript behavior tests.

Overall — 54 / 100

Raw 36 / 67 → round(36 / 67 × 100) = 54

---

Scored against SCORECARD.md on 2026-10-05 with solstice-1.