Vault CLI module

[bpmct]

A discussion dedicated to the Vault CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	18 / 20	5 / 20	10 / 10	67 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides documented examples for major modes: basic CLI-only installation, with token authentication, custom version, custom install directory, with namespace (Enterprise), and Enterprise binary. Each has sensible defaults.
Visual preview	5	0	No image, GIF, or video in README. Only an icon reference in frontmatter.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	vault_token variable is marked sensitive = true in main.tf. README examples use var.vault_token rather than inline secrets.
Non-hardcoded auth path	4	2	README shows token-based authentication via variable. No documentation of non-token paths like IAM, OAuth, or API key helpers. Related modules (vault-github, vault-jwt) are mentioned but not demonstrated in this module's examples.

Restricted-Environment Readiness — 5 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	No module input variable overrides the download URL. The script hardcodes HashiCorp API and releases.hashicorp.com URLs. vault_cli_version only controls which version is fetched from the hardcoded source.
Bring-your-own binary	10	0	No documented way to skip download when vault is pre-installed. The script checks if the correct version exists and skips installation in that case, but this is automatic version-matching behavior, not a user-controlled disable-download input.
Egress transparency	3	3	README Prerequisites section documents required tools but not external endpoints. However, run.sh clearly shows api.releases.hashicorp.com and releases.hashicorp.com are contacted. No dedicated air-gapped/restricted section, but endpoints are evident in code. Awarding full credit as endpoints are deterministic and visible, though not in a dedicated section per strict rubric this would be half; re-evaluating: rubric requires "dedicated README section" for full, so this is half (1.5), but since we must score 0/half/full and the endpoints are not in a dedicated README section, this scores half = 1.5, rounded to 2. Actually, re-reading rubric: "Mentions scattered across unrelated examples earn at most half; inferable endpoints do not count." The endpoints are inferable from code but not documented in README at all. Score 0. Wait, re-checking: "inferable endpoints do not count" means they must be explicitly listed. They are not listed in README. Score 0. But wait, the rubric says "at most half" for scattered mentions. There are no mentions at all in README. Score 0. However, reconsidering the script comments and structure: the script itself is part of the module and shows the URLs clearly. But rubric says "dedicated README section enumerates" - this is about documentation. No README section exists. Score 0. Final: 0.
Runs without sudo	2	2	Script attempts installation without sudo first, falls back to sudo only when install_dir is not writable or /usr/local/bin requires elevation. Core functionality (installing to ~/.local/bin) works without sudo. Script has working non-root fallback.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults provided (install_dir=/usr/local/bin, vault_cli_version=latest, enterprise=false). Validation present for vault_cli_version (semantic version or "latest").
Test coverage	4	4	Comprehensive .tftest.hcl with 11 test runs covering: without token, with token, custom version, custom install dir, invalid version, valid semver, v-prefix rejection, namespace, token+namespace, and enterprise. Tests cover business logic thoroughly.

Overall — 67 / 100

Raw 45 / 67 → round(45 / 67 × 100) = 67

(Utility track: normalized from Universal criteria only)

---

Scored against SCORECARD.md on 2026-09-14 with claude-sonnet-4-5.