Create a HCP Vault Dedicated cluster

All HCP Vault Dedicated clusters are associated with a HashiCorp Virtual Network (HVN). You can create an HVN either before, or during the HCP Vault Dedicated cluster process.

Refer to the HashiCorp Virtual Network documentation for more information.

You can either start from scratch which will create an empty Vault cluster, or you can select a template which will configure Vault plugins to support the given template.

Start from scratch

Log into the HCP Portal.
Navigate to the HCP project you want to create an HCP Vault Dedicated cluster in.
From the Overview page, click Get started with Vault.
From the Set up your cluster page, click Create cluster in the Start from scratch pane.
Select your preferred cloud service provider.
Select a Vault tier and cluster size.
Enter a unique HVN name and select the desired region.
Enter a CIDR block that does not overlap with other CIDR blocks in your environment.
Enter an ID for the cluster.
Select the Start from scratch option.
Click Create cluster.
Wait for the cluster completion process to complete and proceed to the Generate admin token documentation.

Start from a template

There are 3 templates available to choose from if you do not want to start from scratch:

Template name	Description
Encryption	Creates a Vault cluster with: Transit secrets engine enabled Approle auth method enabled A policy to permit access to the Transit secrets engine A key to encrypt and decrypt data
Key-value secrets	Creates a Vault cluster with: Key/Value secrets engine enabled Approle auth method enabled A policy to permit access to the Key/Value secrets engine A secret stored in the Key/Value secrets engine
PKI	Creates a Vault cluster with: PKI secrets engine enabled Approle auth method enabled A policy to permit access to the PKI secrets engine A root certificate authority (CA) An intermediate CA An example certificate

Navigate to the HCP project you want to create an HCP Vault Dedicated cluster in.
From the Overview page, click Get started with Vault.
From the Set up your cluster page, click the template you want to have applied to your Vault cluster.
From the Create Cluster form, select your preferred cloud provider, cluster tier and size, and enter a cluster name.
Click Create cluster.
Wait for the cluster completion process to complete and proceed to the Generate admin token documentation.

Data plane account details

HCP Vault Dedicated provides access to data plane account details directly from the cluster overview page. These details identify the cloud resources and identities associated with your Vault cluster and can be used when configuring trust relationships, validating cloud account ownership, or integrating with cloud-native services that require account-specific information.

Providing this information in the HCP portal enables customers to quickly retrieve account details when required.

For AWS-based clusters, the AWS account details panel includes:

Account ID
Data plane IAM role
AWS IAM trust policy

These details can be used when configuring cross-account access and establishing trust relationships between your AWS environment and the Vault data plane.

Access data plane account details

To view data plane account details:

Log in to the HCP portal.
Navigate to your HCP Vault Dedicated cluster.
Open the Overview page.
In the Cluster networking section, select the arrow icon next to Provider.

The account details panel opens and displays the cloud account and identity information associated with the selected HCP Vault Dedicated cluster.

Tutorial

Refer to the following step-by-step tutorials to learn more:

Create a Vault cluster on HCP