HashiConf 2025 Don't miss the live stream of HashiConf Day 1 happening now. View live stream
HashiCorp Cloud Platform
HashiCorp Cloud Platform Home

Secrets inventory reporting

Beta feature

This feature is currently available as beta. The beta functionality is stable but possibly incomplete and subject to change. We strongly discourage using beta features in production.

Limitations for beta

The secrets inventory reporting is available for:

  • A new HCP Vault Dedicated cluster running on Amazon Web Services
  • Key/value secrets engine version 1 and version 2

Integrating Vault as your secrets management can increase security, and reduce operational overhead to protect sensitive data. However, it is critical to set the right permissions to control access to those data.

Vault secrets inventory reporting increases visibility into the secrets Vault manages through the UI and API. The reporting services use telemetry to collect and surface data about when secrets are being accessed, modified, and destroyed.

Enable secrets inventory reporting

Sign up for the beta program

Before you can enable reporting in your Vault clusters, HashiCorp has to enable a feature flag for your organization. Fill out the form to participate in the beta program.

  1. Log into the HCP Portal.

  2. Navigate to the HCP project you want to create an HCP Vault Dedicated cluster in.

  3. Select Vault Dedicated, and click Create cluster and make your cluster selections.

    Tip

    Refer to the create a new HCP Vault Dedicated cluster page for more details.

  4. Select the Enable reporting toggle button. Enable the inventory reporting when you create a cluster

  5. Click Create cluster.

Once the cluster is up and running, you can start storing secrets.

View secrets inventory report

The admin role has access to secrets inventory reporting. For non-admin users, you need the secrets inventory report reader role for Vault reporting service in addition to view the report.

Tip

Refer to the access management page to learn more about assigning IAM roles.

  1. In the HCP Portal, select Vault Dedicated.

  2. Select Secrets Inventory. Secrets inventory reporting dashboard example

    You can filter the data using the quick filters. Also, you can order the Last accessed and Last modified timestamps in ascending or descending dates.

Available column data

You can select or deselect the column fields to display. Secrets inventory reporting dashboard example

The table below lists available column fields and their description.

Table ColumnDescription
Secret nameThe secret key of the data. Type of secret can be static, dynamic, or auto-rotating.
EngineType of secrets engine (KV v1, KV v2, AWS, GCP, Azure, database, transit, etc.)
NamespaceThe Vault namespace where the secrets created in.
Mount pathThe path of the secrets engine or authentication method has enabled at.
CreatedThe timestamp of secret creation and entity ID of user who created the secret.
Last modifiedThe timestamp of when the secret was last modified, and the entity ID of who modified the secret such as changing the secret values, deleting or undeleting a secret.
Last accessedThe timestamp of when the secret was last accessed (read or used).
VersionsThe version of the secrets associated with KV v2 secrets.
Next rotationThe next rotation date of the secret based on the rotation policy.
TTLHow long a secret remains valid based on time-to-live (TTL) policy.
DeletedDeleted or destroyed secrets.

Download secrets inventory report

You can export the secrets inventory report data with filters applied.

  1. From the Secrets Inventory page, click Export.
  2. Select the desired file format: JSON, or CSV.
  3. Click Continue.
  4. Click Download records, and select the download location.

Note

You can export up to 1,000 rows of data. When the filtered report exceeds 1,000 rows of data, it returns an error.