Deprecation notices

Vault implements a multi-phased approach to deprecations to provide users with advanced warning, minimize business disruptions, and allow for the safe handling of data affected by a feature removal.

Deprecations

Snowflake DB password authentication

Snowflake plans to disable password authentication for all users in November of 2025.

As of Vault 1.20.x, the Snowflake database secrets engine supports key-pairs in place of passwords for root credentials.

Pending removal

Vault Agent API proxy

Built-in API proxy support for Vault Agent is deprecated. We recommend migrating to Vault Proxy if you require proxy functionality.

Duplicate HCL attributes

The ability to duplicate attributes in HCL configuration files and policy definitions is deprecated.

To find affected policies, look for "policy contains duplicate attributes" warnings in the server logs. Once we remove support for duplicate attributes, you cannot interact with affected policies. For example, Vault will return an error if you try to create a token referencing an affected policy or use an existing token that references the policy.

The Vault CLI now checks provided configuration files to determine if the file is subject to the duplicate parameter deprecation and returns a warning about the issue.

Exact-match list comparison on allowed_parameters and denied_parameters

The behavior of allowed_parameters and denied_parameters policy rules when evaluating list-type request parameters is changing in Vault v1.21.0. During the deprecation period the environment variable VAULT_LEGACY_EXACT_MATCHING_ON_LIST can be set to revert to the legacy behavior.

Refer to list parameter evaluation for more information on the behavior change.

Removed

Ruby client libraries

If you are interested in assuming ownership and providing future maintenance:

1. Fork the relevant GitHub repo: hashicorp/vault-ruby or hashicorp/vault-rails.
2. Open a GitHub issue in the relevant repo, mention the deprecation notice, and indicate your desire to take over the project.

AWS secrets engine field change

The security_token field returned for AssumeRole and FederationToken credentials is deprecated in favor of session_token.

For more information, consult the AWS secrets engine API documentation.

Centrify auth method

Vault no longer provides official support for the Centrify auth method plugin.

Active Directory secrets engine

We no longer support the Active Directory secrets engine.

Duplicative Docker images

Previously, HashiCorp published and updated separate, identical Docker images of Vault as a Verified Publisher image and Official image. As of v1.12, Vault no longer supports the vault Docker image and will remove all duplicative Vault Docker images. To continue receiving updates, you will need to use the Verified Publisher hashicorp/vault image on DockerHub.

Azure secrets password policy

The password_policy field for the Azure secrets plugin is deprecated. The MS Graph API now returns passwords to the client rather than accepting passwords as part of the request. As a result, the password_policy field is unusable.

For more information, consult the Microsoft documentation for MS GRAPH APP API and MS GRAPH SP API.

Internal counters tokens API

Vault no longer supports the /sys/internal/counters/tokens endpoint, which returned the number of tokens that were used a Vault cluster.

Deprecation phases

The lifecycle of a Vault feature or plugin includes 4 phases:

• supported - generally available (GA), functioning as expected, and under active maintenance
• deprecated - marked for removal in a future release
• pending removal - support ended or replaced by another feature
• removed - end of lifecycle

Deprecated

"Deprecated" is the first phase of the deprecation process and indicates that the feature is marked for removal in a future release. When you upgrade Vault, newly deprecated features will begin alerting that the feature is deprecated:

• Built-in authentication and secrets plugins log Warn-level messages on unseal.
• All deprecated features log Warn-level messages.
• All POST, GET, and LIST endpoints associated with the feature return warnings in response data.

Built-in Vault authentication and secrets plugins also expose their deprecation status through the Vault CLI and Vault API.

Pending removal

"Pending removal" is the second phase of the deprecation process and indicates that the feature behavior is fundamentally altered in the following ways:

• Built-in authentication and secrets plugins log Error-level messages and cause an immediate shutdown of the Vault core.
• All features pending removal fail and log Error-level messages.
• All CLI commands and API endpoints associated with the feature fail and return errors.

Removed

"Removed" is the last phase of the deprecation process and indicates that the feature is no longer supported and no longer exists within Vault.

Migrate from deprecated features

Features in the "pending removal" and "removed" phases will fail, log errors, and, for built-in authentication or secret plugins, cause an immediate shutdown of the Vault core.

Migrate away from a deprecated feature and successfully upgrade to newer Vault versions, you must eliminate the deprecated features:

1. Downgrade Vault to a previous version if necessary.
2. Replace any "Removed" or "Pending removal" feature with the recommended alternative.
3. Upgrade to latest desired version.