# HashiCorp Vault basic workflows

**URL:** <https://discuss.hashicorp.com/t/hashicorp-vault-basic-workflows/11790>\
**Category:** Vault\
**Created:** [July 21, 2020, 10:52pm UTC](https://discuss.hashicorp.com/t/hashicorp-vault-basic-workflows/11790 "2020-07-21T22:52:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![evanniedojadlo](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/evanniedojadlo/32/6423_2.png) [@evanniedojadlo](https://discuss.hashicorp.com/u/evanniedojadlo)\
**Post date:** [July 21, 2020, 10:52pm UTC](https://discuss.hashicorp.com/t/hashicorp-vault-basic-workflows/11790/1 "2020-07-21T22:52:48Z")

</div>

We setup HashiCorp Vault and need to create a simple static key/value store within the KV secrets engine. Who is ultimately responsible for creating this secret or secrets in general?

Should we create a username/password for that particular user so that they can create the secret and manage it?

I am trying to wrap my head around a standard vault workflow. Also, when we create secret engines/secrets within the root account are these shared across other users or do we need to grant access?

Thank you,

---

<div class="post-metadata">

**Author:** ![martinhristov90](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/martinhristov90/32/36757_2.png) [@martinhristov90](https://discuss.hashicorp.com/u/martinhristov90)\
**Post date:** [July 22, 2020, 6:06am UTC](https://discuss.hashicorp.com/t/hashicorp-vault-basic-workflows/11790/2 "2020-07-22T06:06:16Z")

</div>

Hello,

Regarding this :

```auto
We setup HashiCorp Vault and need to create a simple static key/value store within the KV secrets engine. Who is ultimately responsible for creating this secret or secrets in general?

```

The short answer would be anybody who has access to that path. Vault makes heavy usage of paths, the best way I find thinking about Vault’s structure is that it resembles filesystem with `files and folders`.  
If your secret lives in `secret/my-secret` path, every user who possesses a [policy](https://learn.hashicorp.com/vault/identity-access-management/iam-policies) allowing managing that path would be able to read and modify the secret (`my-secret`).

Regarding this :

```auto
Should we create a username/password for that particular user so that they can create the secret and manage it?

```

That would be preferable, you can create a policy that has limited scope to that particular secret. Here is a simple policy that defines full set of permissions to `secret/my-secret` path :

```auto
path "secret/my-secret"
{
  capabilities = ["create", "read", "update", "delete", "list"]
}

```

Regarding this :

```auto
I am trying to wrap my head around a standard vault workflow. Also, when we create secret engines/secrets within the root account are these shared across other users or do we need to grant access?

```

The secrets are written in particular paths, accessing a secret strictly depends on the policies assigned to the user (token) that is trying to access it.

Martin

---

<div class="post-metadata">

**Author:** ![evanniedojadlo](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/evanniedojadlo/32/6423_2.png) [@evanniedojadlo](https://discuss.hashicorp.com/u/evanniedojadlo)\
**Post date:** [July 24, 2020, 2:14am UTC](https://discuss.hashicorp.com/t/hashicorp-vault-basic-workflows/11790/3 "2020-07-24T02:14:23Z")

</div>

thank you! just to confirm, the single token associated with a username/password will only be capable of completing the actions based on the policy or policies assigned to that token? I’m reading the documentation now but just want to ensure that I’m not overlooking anything. The concepts are beginning to make sense now.

---

<div class="post-metadata">

**Author:** ![martinhristov90](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/martinhristov90/32/36757_2.png) [@martinhristov90](https://discuss.hashicorp.com/u/martinhristov90)\
**Post date:** [July 24, 2020, 5:51am UTC](https://discuss.hashicorp.com/t/hashicorp-vault-basic-workflows/11790/4 "2020-07-24T05:51:08Z")

</div>

Hello,

Regarding this :

```auto
just to confirm, the single token associated with a username/password will only be capable of completing the actions based on the policy or policies assigned to that token?

```

You are correct, the actual permissions are based on the policies attached to the token. The token itself might be created by various different auth method, for example : `userpass` (end user has username and password that are local to Vault) , `OIDC` , `LDAP` and so on.

The easiest way i found to think about tokens is that they resemble session cookies to some degree.

Martin

---

<div class="post-metadata">

**Author:** ![evanniedojadlo](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/evanniedojadlo/32/6423_2.png) [@evanniedojadlo](https://discuss.hashicorp.com/u/evanniedojadlo)\
**Post date:** [July 24, 2020, 6:11am UTC](https://discuss.hashicorp.com/t/hashicorp-vault-basic-workflows/11790/5 "2020-07-24T06:11:50Z")

</div>

“The easiest way i found to think about tokens is that they resemble session cookies to some degree.” makes perfect sense, thank you!