Hashicorp Vault Integration (Token) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
13 / 25	18 / 20	7 / 20	8 / 10	61 / 100

Drilldown

Presentation & Onboarding — 13 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides multiple examples: basic token auth, custom CLI version install. Each shows sensible defaults and covers the major configuration modes.
Coder-context framing	8	1	Mentions "Coder workspaces" once but does not explain what the module adds on top of Coder or where Coder fits in the Vault authentication flow. No explanation of how this integrates with Coder's workspace lifecycle.
Visual preview	5	0	No image, GIF, or video. Only an icon reference in frontmatter.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token variable is marked sensitive = true in main.tf. README examples use var.token reference, not inline secrets.
Non-hardcoded auth path	4	2	README shows creating a Vault token via CLI but does not document alternative auth paths like Vault's Kubernetes auth, AWS IAM, or other dynamic credential methods that avoid static tokens. Partial credit for showing token creation workflow.

Restricted-Environment Readiness — 7 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	0	The download URL https://releases.hashicorp.com/vault/... is hardcoded in run.sh. No module input variable allows overriding this URL to point to an internal mirror.
Bring-your-own binary	5	5	The install logic in run.sh checks if command -v vault and skips installation if the correct version is already present, effectively supporting pre-baked binaries. Documented in the version-specific example.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The URLs https://releases.hashicorp.com appear only in source code, not documented for restricted environments.
Runs without sudo	2	2	run.sh attempts sudo mv but falls back to ~/.local/bin when sudo fails, with a PATH message. Core functionality works without sudo.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. vault_cli_version has validation regex for version format. Sensible defaults: vault_cli_version = "latest", optional vault_token and vault_namespace.
Test coverage	4	2	main.test.ts only tests required variables via testRequiredVariables. No business logic tests in .tftest.hcl (no such file present). No end-to-end tests of Vault CLI installation or token auth.

Overall — 61 / 100

Raw 46 / 75 → round(46 / 75 × 100) = 61

Note: Scored as Utility module (Vault integration/auth helper). Normalized from 75-point denominator.

---

Scored against SCORECARD.md on 2026-08-10 with claude-sonnet-4-5.