Hashicorp Vault Integration (JWT) module

[bpmct]

A discussion dedicated to the Hashicorp Vault Integration (JWT) module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	12 / 20	1 / 20	8 / 10	49 / 100

Drilldown

Track: Utility (Vault auth/integration module — no agent or IDE surface)

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README has multiple distinct configuration examples: custom auth path, group→role mapping, pinned CLI version, custom display name, and a full custom-JWT-token flow with signing resource and policy examples. Covers the module's major option surfaces.
Visual preview	5	0	No image, GIF, or video anywhere in the README.

Credential Hygiene — 12 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	vault_jwt_token is correctly marked sensitive = true in main.tf, but the top-level README example inlines a literal-looking token value (vault_jwt_token = "eyJhbGciOiJIUzI1N..."), which caps this at half per calibration.
Non-hardcoded auth path	4	4	Defaults to reusing data.coder_workspace_owner.me.oidc_access_token when vault_jwt_token is unset, explicitly documented in the top example ("defaults to user's oidc authentication token").

Restricted-Environment Readiness — 1 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	0	run.sh hardcodes https://releases.hashicorp.com/vault/... for the download; no module variable (e.g., vault_cli_version only pins a version string, not a URL) overrides the download source.
Bring-your-own binary	10	0	No documented variable or flag to skip install entirely when Vault is pre-baked. The script auto-skips reinstall only if an existing binary happens to match the pinned version — this is implicit behavior, not a documented bypass.
Egress transparency	3	0	No dedicated network/offline/air-gapped section in the README enumerating contacted endpoints.
Runs without sudo	2	1	run.sh attempts sudo mv vault /usr/local/bin/vault 2>/dev/null but falls back to ~/.local/bin and prints a PATH notice if sudo fails — sudo is optional with a working non-root fallback, which earns half per calibration.

Engineering Quality — 8 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions and sensible defaults (vault_jwt_auth_path = "jwt", vault_cli_version = "latest", display_name); vault_cli_version has a regex validation block.
Test coverage	4	2	main.test.ts only runs terraform init and testRequiredVariables, with no .tftest.hcl business-logic tests and no end-to-end TypeScript assertions on actual behavior.

Overall — 49 / 100

Raw 33 / 67 → round(33 / 67 × 100) = 49

---

Scored against SCORECARD.md on 2026-10-05 with solstice-1.