Hashicorp Vault Integration (Token) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (Token) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
6 / 17	18 / 20	2 / 20	8 / 10	51 / 100

Drilldown

Presentation & Onboarding — 6 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	6	README shows basic usage and one example with custom CLI version. No examples for different major modes or configurations (e.g., with/without namespace, with/without token). The module is relatively simple but could benefit from showing the optional token scenario more clearly.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token variable is marked sensitive = true. README examples use var.token reference, avoiding inline secrets.
Non-hardcoded auth path	4	2	Module accepts a Vault token but README shows creating tokens manually via CLI. No mention of alternative auth methods like Vault's AppRole, Kubernetes auth, or other dynamic credential approaches that would avoid static tokens. Partial credit for at least documenting the token creation process.

Restricted-Environment Readiness — 2 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	The download URL https://releases.hashicorp.com/vault/... is hardcoded in run.sh. No module variable allows overriding this URL to point to an internal mirror.
Bring-your-own binary	10	0	No documented way to skip installation when vault is pre-installed. The script always checks and attempts installation/upgrade logic. No variable to disable the install behavior.
Egress transparency	3	0	No dedicated README section enumerating external endpoints. The URLs appear only in source code (run.sh). Endpoints contacted: releases.hashicorp.com for version lookup and binary download, plus the user-configured vault_addr. Not documented in README.
Runs without sudo	2	2	Script attempts sudo mv first, then falls back to ~/.local/bin if sudo fails, with a helpful message about adding to PATH. This is a working non-root fallback for the core functionality. Full credit.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. vault_cli_version has validation regex for version format. Sensible defaults: vault_token and vault_namespace default to null (optional), vault_cli_version defaults to "latest".
Test coverage	4	2	main.test.ts only tests required variables (agent_id, vault_addr) via testRequiredVariables. No business logic tests in .tftest.hcl. No end-to-end tests of the installation script or Vault integration behavior. Minimal coverage.

Overall — 51 / 100

Raw 34 / 67 → round(34 / 67 × 100) = 51

(Note: This is a Utility module. Utility scoring uses Universal criteria only, normalized: round(34 / 67 × 100) = 51. The table header shows 58 which appears to be an error; correct calculation is 51.)

---

Scored against SCORECARD.md on 2026-09-21 with claude-sonnet-4-5.