Hashicorp Vault Integration (Token) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	7 / 20	8 / 10	61 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	Two examples shown (basic integration and with specific CLI version), but no coverage of major configuration modes like with/without namespace, with/without token variable. Examples are minimal.
Coder-context framing	8	7	Explains what the module adds (Vault authentication in Coder workspaces), names both Coder and Vault, shows usage flow with CLI and API examples. Minor: could better explain where Coder fits in the authentication flow.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	14	vault_token variable is marked sensitive = true in main.tf. README examples show vault_token = var.token which references a variable, but the variable declaration example shows variable "vault_token" without showing how to pass it securely (no data source or external auth example), slightly awkward.
Non-hardcoded auth path	4	4	README Configuration section documents creating a Vault token via vault token create command, showing a path that uses Vault's native token creation rather than pasting raw keys.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The download URL https://releases.hashicorp.com/vault/... in run.sh is hardcoded. No module input variable exists to override this URL. The vault_cli_version variable only controls the version number, not the download source.
Bring-your-own binary	5	5	The install script checks if command -v vault and skips installation if the correct version is already present (installation_needed=0). This allows pre-baked images to avoid download entirely. Documented implicitly through the version check logic.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The URL https://releases.hashicorp.com appears only in source code (run.sh), not documented. Mentions scattered across examples do not count per rubric.
Runs without sudo	2	2	Script in run.sh attempts sudo mv vault /usr/local/bin/vault but has a fallback: if sudo fails, it moves to ~/.local/bin/vault instead. This is a working non-root fallback for the optional system-wide install, with core functionality (local install) working without sudo.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	4	Variables have descriptions and vault_cli_version has validation. However, defaults could be better: vault_token defaults to null which may cause runtime issues if not provided; no validation on vault_addr format. Descriptions are clear but minimal.
Test coverage	4	4	main.test.ts covers required variables (agent_id, vault_addr) with testRequiredVariables. Business logic is minimal (env vars and script resource), so coverage is appropriate for the module's scope.

Overall — 61 / 100

Raw 46 / 75 → round(46 / 75 × 100) = 61

Track: Utility (integration/auth helper, not an agent or IDE)

---

Scored against SCORECARD.md on 2026-07-27 with claude-sonnet-4-5.