Vault CLI module

[bpmct]

A discussion dedicated to the Vault CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	7 / 20	10 / 10	64 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Multiple documented examples cover major modes: basic CLI-only installation, with token authentication, custom version, custom install directory, with namespace (Enterprise), and Enterprise binary. Each has sensible defaults.
Coder-context framing	8	1	README mentions "Coder agent" in variable descriptions but does not explain what the module adds on top of Coder or show where Coder fits in the Vault workflow. No framing of how Coder orchestrates Vault CLI installation.
Visual preview	5	0	No image, GIF, or video in README. Icon reference exists but is not embedded preview content.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token variable is marked sensitive = true in main.tf. README examples use var.vault_token rather than inline secrets.
Non-hardcoded auth path	4	2	README shows token-based authentication via variable. Does not document OAuth, IAM, ServiceAccount, or other non-token paths. Related modules section mentions vault-github and vault-jwt for advanced auth, but this module itself only supports token auth. Partial credit for acknowledging better paths exist elsewhere.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	No module input variable overrides the download URL. The script hardcodes HashiCorp API endpoints and releases.hashicorp.com URLs. vault_cli_version controls which version but not the source URL.
Bring-your-own binary	5	0	No documented way to skip installation when vault is pre-installed. Script always attempts installation check and will install if version mismatches. No skip/disable flag.
Egress transparency	3	1.5	No dedicated README section for network requirements or air-gapped environments. Endpoints are inferable from code (api.releases.hashicorp.com, releases.hashicorp.com) but not enumerated in documentation. Partial credit for Prerequisites section mentioning required tools, but it doesn't list external endpoints.
Runs without sudo	2	2	Script in run.sh attempts non-sudo installation first, falls back to sudo only when install_dir is not writable, and has a final fallback to ~/.local/bin without sudo. Core functionality works without root. Full credit.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults: install_dir="/usr/local/bin", vault_cli_version="latest", enterprise=false. Validation on vault_cli_version enforces "latest" or semver format, rejects v-prefix.
Test coverage	4	4	Comprehensive .tftest.hcl with 11 test runs covering: without token, with token, custom version, custom install dir, invalid version, valid semver, v-prefix rejection, namespace, token+namespace, enterprise flag. Tests verify resource properties and outputs. Clear testing story.

Overall — 64 / 100

Raw 48 / 75 → round(48 / 75 × 100) = 64 → 64 / 100

Utility module normalized: round(48 / 75 × 100) = 64

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.