Integrating Vault as your secrets management can increase security, and reduce operational overhead to protect sensitive data. However, it is critical to set the right permissions to control access to those data.

Vault secrets inventory reporting increases visibility into the secrets Vault manages through the UI and API. The reporting services use telemetry to collect and surface data about when secrets are being accessed, modified, and destroyed.

Enable secrets inventory reporting

To enable reporting on setup of a new Vault clusters, select the 'Enable Reporting' option when creating a new cluster.

1. Log into the HCP Portal.

2. Navigate to the HCP project you want to create an HCP Vault Dedicated cluster in.

3. Select Vault Dedicated, and click Create cluster and make your cluster selections.

   Tip

   Refer to the create a new HCP Vault Dedicated cluster page for more details.

4. Select the Enable reporting toggle button.

5. Click Create cluster.

Once the cluster is up and running, you can start storing secrets.

Enable Reporting on existing clusters

To enable reporting on existing clusters, select the 'Enable Reporting' option when editing the configuration of an existing cluster. This will scan the Vault cluster and collect telemetry about current state of Vault to populate the secret inventory report.

Note that this scanning will not work for certificates in the cluster. It is recommended that reporting be enabled for certificates at the outset of certificate cluster creation. Alternatively if certificates already exist, reporting should be enabled for that cluster and allowed to soak for 60 days before beginning to use the reporting functionality so that it is populated with certificates.

Scanning can take up to 2 hours depending on the size of the cluster and will be in an updating state where reporting is not accessible while scanning. There will be a column titled Scanned At which denotes the date and time a secret was scanned and its telemetry data added to the reporting service.

1. Log into the HCP Portal.

2. Navigate to the HCP project you want to create an HCP Vault Dedicated cluster in.

3. Select Vault Dedicated, and click on the cluster you want to enable reporting for.

4. Click on Manage and from the dropdown menu, select the Edit Congiguration option.

5. On the cluster edit configuration screen, select the Enable reporting toggle button.

Disabling Reporting on a Cluster

Disabling reporting on a cluster is possible by following the steps below. However it is not recommended that reporting be disabled as the data will be deleted from our systems. Scanning an existing cluster multiple times will result in loss of data from the date that reporting was first disabled on the cluster, and re-enrolling the same cluster will result in

For security purposes, HashiCorp does not retain data which ahs been deleted and cannot provide a backup of reporting data once reporting has been disabled.

View secrets inventory report

The admin role has access to secrets inventory reporting. For non-admin users, you need the Report reader role for Vault reporting service in addition to view the report.

This grants access to certificate reporting as well as secret inventory reporting, and the ability to use a cluster's Saved Views but not modify them.

1. In the HCP Portal, select Vault Dedicated.

2. Select Secrets Inventory.

   You can filter the data using the saved views. Also, you can order the Last accessed and Last modified timestamps in ascending or descending dates.

Available column data

You can select or deselect the column fields to display.

The table below lists available column fields and their description.

Saved views

Saved Views are a combination of filters and fields applied to the Secret Inventory report to return a specific set of data. There are 3 saved views by default on your cluster when reporting is enabled. Static secrets not accessed in the last 90 days, Upcoming secret rotations in the next 30 days, and Long lived secrets that have not been updated in 90+ days.

These saved views can be rearranged and modified to your specific organization's needs. As an administrator, you can edit and modify existing saved views which are available to any Report Reader or other admins on the Vault cluster to use. Project members with the Report reader role will be able to use Saved Views that admins create but cannot modify them.

Create a saved view

1. Create a saved view by making selections from the the Secrets Engine, Filters or Fields drop downs
2. Click on saved view to the right of the Fields drop down
3. Give your saved view a name which describes the data it is surfacing and a description of how to use that saved view
4. Click Save and your saved view will appear in the carousel in the last position

Modify a saved view

1. Click on the three dots to the right of the saved view title
2. Select Rename
3. Make edits
4. Click Update

Rearrange your saved views by clicking on the three dots to the right of the saved view title and selecting Rearrange. Drag and drop the saved views in your preferred order and click save.

Download secrets inventory report

You can export the secrets inventory report data with filters applied.

1. From the Secrets Inventory page, click Export.
2. Select the desired file format: JSON, or CSV.
3. Click Continue.
4. Click Download records, and select the download location.