# Integrating SailPoint with HashiCorp Vault Integration (Cloud)

Use the HashiCorp Vault Integration (Cloud) connector to discover and aggregate non-human identities (NHIs) from HCP Vault Dedicated into SailPoint. The connector supports HCP Vault Dedicated Essentials and Standard tiers.

The connector authenticates to one Vault namespace through AppRole and aggregates metadata for the following NHI types:

- Agents and machines
- Service accounts
- Personal access tokens (PATs) and tokens
- Secrets
- API keys

The connector provides read-only discovery. It does not retrieve secret values.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

| Feature | Description |
| --- | --- |
| Test connection | Validates the connection to HashiCorp Community Vault. |
| Dataset aggregation | Aggregates HashiCorp configuration and metadata into the datasets. |

### Non-Human Identity Discovery

- Aggregate Vault agents and machines, service accounts, tokens and PATs, secrets, and API keys

Refer to Dataset Management for more information.

Refer to [Discovering Potential Non-Human Accounts](<https://documentation.sailpoint.com/saas/help/agentic_fabric/nhi/non_human_accounts.html#discovering-potential-non-human-accounts>) for more information.

### Supported Platform

The connector supports HCP Vault Dedicated Essentials and Standard tiers.

## Prerequisites

Before you configure the HashiCorp Vault Integration (Cloud) source for HCP Vault Dedicated Essentials or Standard, prepare the target Vault namespace and AppRole.

- Use an HTTPS Vault cluster URL with a valid certificate.
- Use a Vault account that can create a policy and AppRole in the target namespace.

> [!IMPORTANT]
>
> Create the policy and AppRole in the target namespace. The connector accesses one namespace and reads metadata only.

### Creating the Vault ACL Policy

1. Save the required policy rules in a file named `sail-connector.hcl`.

   ```text
   path "sys/health"                 { capabilities = ["read"] }
   path "sys/auth"                   { capabilities = ["read", "list"] }
   path "sys/mounts"                 { capabilities = ["read", "list"] }
   path "sys/wrapping/lookup"        { capabilities = ["update"] }
   path "sys/wrapping/unwrap"        { capabilities = ["update"] }
   path "auth/token/renew-self"      { capabilities = ["update"] }
   ```
2. Add the following rules for the NHI types that you want the connector to discover.

   ```text
   # Agents and machines (AppRole) and service accounts (Kubernetes)
   path "auth/+/role"                { capabilities = ["list"] }
   path "auth/+/role/*"              { capabilities = ["read"] }
   path "identity/lookup/entity"     { capabilities = ["update"] }
   path "identity/entity/id"         { capabilities = ["list"] }
   path "identity/entity/id/*"       { capabilities = ["read"] }
   path "identity/group/id/*"        { capabilities = ["read"] }

   # Tokens
   path "auth/token/accessors"       { capabilities = ["list"] }
   path "auth/token/lookup-accessor" { capabilities = ["update"] }

   # API keys (dynamic credentials; database engine shown)
   path "database/roles"             { capabilities = ["list"] }
   path "database/roles/*"           { capabilities = ["read"] }
   path "database/static-roles"      { capabilities = ["list"] }
   path "database/static-roles/*"    { capabilities = ["read"] }
   path "sys/policies/acl"           { capabilities = ["list"] }
   path "sys/policies/acl/*"         { capabilities = ["read"] }

   # Secrets (KV v2 metadata only)
   path "+/metadata"                 { capabilities = ["list"] }
   path "+/metadata/*"               { capabilities = ["list", "read"] }
   ```

   > **Warning**
   >
   > Do not grant access to KV v2 `data/*` paths. The connector requires metadata access only.
3. Write the policy to the target namespace.

   ```text
   vault policy write -namespace=<target> <policy-name> sail-connector.hcl
   ```

### Creating the AppRole Credentials

1. Create an AppRole role that uses the policy.

   ```text
   vault write -namespace=<target> auth/approle/role/<role-name> \
       token_policies=<policy-name> \
       token_ttl="1h" \
       token_max_ttl="4h" \
       secret_id_ttl="0" \
       secret_id_num_uses=0
   ```
2. Read and securely store the Role ID.

   ```text
   vault read -namespace=<target> auth/approle/role/<role-name>/role-id
   ```
3. Generate a Secret ID.

   ```text
   vault write -namespace=<target> -f auth/approle/role/<role-name>/secret-id
   ```
4. Securely store the Secret ID. You enter it in **Secret ID** when you configure the source.