# Authentication to Vault from local machines' repos

**URL:** <https://discuss.hashicorp.com/t/authentication-to-vault-from-local-machines-repos/50688>\
**Category:** Vault\
**Created:** [February 26, 2023, 5:02pm UTC](https://discuss.hashicorp.com/t/authentication-to-vault-from-local-machines-repos/50688 "2023-02-26T17:02:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![anshjain18](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/anshjain18/32/34101_2.png) [@anshjain18](https://discuss.hashicorp.com/u/anshjain18)\
**Post date:** [February 26, 2023, 5:02pm UTC](https://discuss.hashicorp.com/t/authentication-to-vault-from-local-machines-repos/50688/1 "2023-02-26T17:02:29Z")

</div>

Hey team, I need some advice regarding Vault auth!!  
My problem is as follows:

1. My microservices run in 3 environments - local (my machine), stage (ec2), prod(ec2).
2. For the last 2 envs, aws serves as an identity provider through which the microservice can easily authenticate to Vault, and i can define crisp vault policies mapped to IAM roles.
3. But how do I establish vault auth for my local environment as there is no third party which can provide identity.
4. For auth methods like userpass etc. I have to somehow store username passwords on my local machine which I don’t think is a wise idea.

Any help would be highly appreciated.

---

<div class="post-metadata">

**Author:** ![cadayton](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/cadayton/32/3781_2.png) [@cadayton](https://discuss.hashicorp.com/u/cadayton)\
**Post date:** [February 26, 2023, 5:17pm UTC](https://discuss.hashicorp.com/t/authentication-to-vault-from-local-machines-repos/50688/2 "2023-02-26T17:17:19Z")

</div>

Maybe look into Cobbyhole Response Wrapping.

> **[Cubbyhole Response Wrapping | Vault | HashiCorp Developer](https://developer.hashicorp.com/vault/tutorials/secrets-management/cubbyhole-response-wrapping)**
>
> Vault provides the capability to wrap the Vault response and store it in a
> cubbyhole where the holder of the one-time use wrapping token can unwrap it to
> uncover the secret.

---

<div class="post-metadata">

**Author:** ![stuart-c](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/stuart-c/32/10789_2.png) [@stuart-c](https://discuss.hashicorp.com/u/stuart-c)\
**Post date:** [February 26, 2023, 5:27pm UTC](https://discuss.hashicorp.com/t/authentication-to-vault-from-local-machines-repos/50688/3 "2023-02-26T17:27:24Z")

</div>

Why do you say storing passwords on your local machine isn’t a good idea?