HashiCorp Vault authentication with Spring Cloud and Spring Boot

This article explains HashiCorp Vault setup and usage with Spring Cloud and Spring Boot. Vault supports multiple authentication methods, in this article we will discuss 2 of those methods

  1. Token based authentication
  2. AppRole authentication

Update: Starting with Spring Boot 2.4.x, spring boot changed the way config files are processed. Updated the article to reflect the same.


  1. Spring Boot 2.4.x
  2. Spring Cloud Vault Config 3.0.0-SNAPSHOT
  3. Java 11

Vault setup – Standalone

1. Create a directory named HashiCorpVault and store all the setup files, config files there
2. Download vault library from Vault and add it to the PATH
3. Execute the following command to enable vault commands to autocomplete

$ vault -autocomplete-install

4. Create config.hcl file in HashiCorpVault directory

storage “consul” {
address = “”
path = “vault/”

ui = true

listener “tcp” {
address = “”
tls_disable = 1

6. Start consul with the following command
$ consul agent -dev

5. Download consul binary file from https://www.consul.io/downloads.html and add it to the PATH

7. Open a new terminal and execute the following command to start vault
$ vault server -config=<path_to_file>/config.hcl

8. Open one more terminal and execute the following command
$ export VAULT_ADDR=

9. Initialize the vault with the following command and copy the keys somewhere safe

$ vault operator init
Unseal Key 1: E4GnjX+VP9G50uWQNcwpCflzGAMKGR38BbQywgq4I6L8
Unseal Key 2: PYMxcCOswEYMNz7N6UW53Up6nu6y+SjAPwTJOTtkju3d
Unseal Key 3: yuJ5cSxC7tSBR5mMVJ/WJ9bfhhfGb+uwWw9FQR0JKILh
Unseal Key 4: 0vdvEFHM9PHEGMctJrl2ylHqoKQK8DLkfMU6ntmDz6jv
Unseal Key 5: cI8yglWJX+jPf/yQG7Sg6SPWzy0WyrBPvaFTOAYkPJTx

Initial Root Token: 62421926–81b9-b202–86f8–8850176c0cf3

10. Begin unsealing the Vault with the following command. Execute this 3 times, each time enter different keys from step 9
$ vault operator unseal

11. Go to http://localhost:8200/ui/ to see the vault UI

Enable Secret Engine

  1. Go to and click on ‘Enable Secret Engine’ and select ‘KV’ under generic(shown below)
Enable KV Engine

2. In the next screen at the path field, enter ‘secrets’ or ‘vaultdemo’(or any name of your choice)

3. Now go to main screen and select vaultdemo engine and create new secret. It has to be the format <application_name>/<profile>.


4. The application name can also be the format <sub_domain>/<application_name>/<profile>

Ex: vaultdemo/app/pres/dev

5. Click on Create New Version and enter the following passwords

Dev: username=root password=bcmc1234 url=”jdbc:mysql://localhost:3306/bookstore_dev”

Test: username=sa password=”” url=”jdbc:h2:mem:bookstore_test”

Prod: username=root password=bcmc1234 url=”jdbc:mysql://localhost:3306/bookstore_prod”

6. Go to http://localhost:8200/ui/vault/policies/acl and create the ACL policy named vault-demo-policy that controls access to our secret engine (will be created in later steps)

path “vaultdemo/pres/*” {
capabilities = [“read”,”create”,”update”,"list"]

Configure Spring boot project — Token authentication

Go to spring boot project src/main/resources directory and create application.yml file with the following content

name: pres
authentication: TOKEN
token: ${token}
scheme: http
host: localhost
port: 8200
enabled: true
backend: vaultdemo
import: vault://secret/app/pres/

7. Use the following syntax to export token to Linux machine environment variable
$ export VAULT_TOKEN=<Your token>

7. Spring uses bootstrap.yml file to load vault config and key-value pairs required by the spring profiles before initializing the context. The ${VAULT_TOKEN} value will be taken from machine environmental variables.
8. Make sure to include all the profiles in include attribute. This instructs Spring to load those profiles before initializing the context
9. Now create application-dev.yml file with the following content. The keys from the vault should match here i.e ${username},${password},${url}

## Server Properties
port: 8081

import: vault://secret/app/pres/dev
on-profile: "dev"
username: ${username}
password: ${password}
url: ${url}

10. Create application-test.yml and application-prod.yml config files for Test and Prod environments

11. Create maven profiles in pom.xml that will be used to activate the profile. See pom.xml for reference

## Select profile
active: @activatedProperties@

AppRole authentication

  1. Go to and click on ‘Enable New Method’ and select ‘AppRole’
Enable AppRole authentication method

2. Create new app role for your project

$ vault write auth/approle/role/your-app-name-read \secret_id_num_uses=0 \secret_id_ttl=0 \token_num_uses=0 \token_ttl=10m \token_max_ttl=10m \policies=approle-your-app-name-read

3. Retrie the role ID

$ vault read auth/approle/role/your-app-name-read/role-id

4. Get secret ID

$ vault write -f auth/approle/role/your-app-name-read/secret-id

5. Configure Spring Boot project to use App Role authentication. Create application.yml file

authentication: APPROLE
role-id: ${role-id}
secret-id: ${secret-id}
role: pres-read
app-role-path: approle
uri: http://localhost:8200
connection-timeout: 5000
read-timeout: 15000
enabled: true
: vaultdemo
application-name: pres
import: vault://secret/app/pres/

6. During application startup provide role-id and secret-id, which helps Spring Boot app to get username and password from the vault

Build and Run the project

  1. Clone this project and build it using maven. Make sure to pass -Ddev or -Dtest parameter to maven command, which selects spring profile id and passes to application.yml file

    $ mvn clean package -Dtest -DskipTests
  2. Now run the project with the java command. This should start my project using the profile from the previous step

    java -jar target/vaultdemo-0.0.1.jar
  3. Go to http://localhost:8081/api/v1/book/list to see list of books retrieved from the database whose credentials retrieved from Vault

Code uploaded to Github for reference. Happy Coding 🙂

Pavan Kumar Jadda
Pavan Kumar Jadda
Articles: 30

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.