explore recursively your vault by HashiCorp

vault-tree

#!/usr/bin/env bash

function walk() {
  for secret in $(vault list $1 | tail -n +3)
  do
    if [[ ${secret} == *"/" ]] ; then
      walk "${1}${secret}"
    else
      echo "${1}${secret}"
    fi
  done
}

query="${1}"

if [[ ${query} != *"/" ]] ; then
  query=${query}/
fi

echo "${1}"
walk ${query}

https://github.com/Mykolaichenko/vaulter
https://github.com/xuwang/vault-scripts

import hvac

vlt = hvac.Client(url='http://127.0.0.1:8200', token='supersecretsquirrel')

def enum_vault(path=['secret/']):
  stuff = vlt.list("".join(path))
  try:
    keys = stuff['data']['keys']
  except TypeError:
    keys = []
  for k in keys:
    if k.endswith('/'):
      path.append(str(k))
      enum_vault(path)
      path.pop()
    else:
      pathstr = "".join(path) + str(k)
      print(pathstr + "  ==>  " + str(vlt.read(pathstr)['data']))

enum_vault()

hashicorp/vault#2142

vault read -format=json sys/mounts | jq -r '.data | with_entries(select(.value.type=="kv")) | map_values(.type)'
#
vault read -format=json sys/mounts | jq -r '.data | with_entries(select(.key|match("secret"))) | map_values(.options)'

# same for secrets
vault read -format=json sys/mounts | jq -r '.data | with_entries(select(.value.type=="aws")) | map_values(.type)'
# same for auth
vault read -format=json sys/auth | jq -r '.data | with_entries(select(.value.type=="aws")) | map_values(.type)'

# get all AWS access-keys associated with Vault AWS secrets
for item in $(vault read -format=json sys/mounts | jq -r '.data | with_entries(select(.value.type=="aws")) | keys[]'); do
  vault read -format=json $item/config/root | jq -r '.data.access_key'
done

# get all AWS access-keys associated with Vault AWS auth
for item in $(vault read -format=json sys/auth | jq -r '.data | with_entries(select(.value.type=="aws")) | keys[]'); do
  vault read -format=json auth/$item/config/client | jq -r '.data.access_key'
done