# Vault Credential Setup **URL:** \ **Category:** Boundary\ **Created:** [July 22, 2021, 2:21pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165 "2021-07-22T14:21:25Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![ghardak](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/ghardak/32/20259_2.png) [@ghardak](https://discuss.hashicorp.com/u/ghardak)\ **Post date:** [July 22, 2021, 2:21pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/1 "2021-07-22T14:21:25Z")
Trying to setup credential brokering for boundary using vault cloud, but keep getting the following error when trying to create the stores. ````auto Error from controller when performing create on vault-type credential store Error information: Kind: Internal Message: credentialstores.(Service).createInRepo: unable to create credential store: vault.(Repository).CreateCredentialStore: unable to get vault capabilities: unknown: error #0: Error making API request.``` anyone hit this before? ```` ---
**Author:** ![mgaffney](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mgaffney/32/1169_2.png) [@mgaffney](https://discuss.hashicorp.com/u/mgaffney)\ **Post date:** [July 22, 2021, 6:08pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/2 "2021-07-22T18:08:53Z")
It looks like the Vault token you provided doesn’t have the necessary permissions. Did you give the token the permissions in the sample [Vault Boundary Controller Policy](https://www.boundaryproject.io/docs/concepts/domain-model/credential-stores#vault-boundary-controller-policy) in the docs? ---
**Author:** ![ghardak](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/ghardak/32/20259_2.png) [@ghardak](https://discuss.hashicorp.com/u/ghardak)\ **Post date:** [July 23, 2021, 12:54pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/3 "2021-07-23T12:54:14Z")
Hi @mgaffney Token is generated using the controller policy from the docs, but i think your right that its a permission issue with the token. Might be an additional permission missing that is required when using vault enterprise. Currently digging into the logs to see whats going on. ---
**Author:** ![mgaffney](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mgaffney/32/1169_2.png) [@mgaffney](https://discuss.hashicorp.com/u/mgaffney)\ **Post date:** [July 23, 2021, 1:21pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/4 "2021-07-23T13:21:24Z")
Hi @ghardak The `VAULT_TOKEN` environment variable could be causing a problem if it is set. Not sure if that is helpful but I thought I should mention it. Also, are you using Vault namespaces? ---
**Author:** ![louisruch](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/louisruch/32/16291_2.png) [@louisruch](https://discuss.hashicorp.com/u/louisruch)\ **Post date:** [July 23, 2021, 1:42pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/5 "2021-07-23T13:42:18Z")
Hey @ghardak Louis here from the Boundary team, firstly thank you for trying Boundary! Apart from the namespace question from @mgaffney I have two quick follow up questions re your issue: 1. Is that the full error message you are seeing? Looking at the code, the message should be including some more detail at the end - there might be a bug that is truncating that. 2. The specific error you are getting happens when Boundary is trying to verify the Vault capabilities, would it be possible for you to verify being able to reach this endpoint manually, and post the response here? [/sys/capabilities-self - HTTP API | Vault by HashiCorp](https://www.vaultproject.io/api-docs/system/capabilities-self) ---
**Author:** ![ghardak](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/ghardak/32/20259_2.png) [@ghardak](https://discuss.hashicorp.com/u/ghardak)\ **Post date:** [July 23, 2021, 3:06pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/6 "2021-07-23T15:06:16Z")
Hi @louisruch, We are using a Vault Namespaces for each environment, full error message from the controller is below, will run the http api request and see what the output response is. ````auto Error from controller when performing create on vault-type credential store Error information: Kind: Internal Message: credentialstores.(Service).createInRepo: unable to create credential store: vault.(Repository).CreateCredentialStore: unable to get vault capabilities: unknown: error #0: Error making API request. URL: POST https:// **** /v1/sys/capabilities-self Code: 403. Errors: * 1 error occurred: * permission denied Status: 500 context: Error from controller when performing create on vault-type credential store``` ```` ---
**Author:** ![louisruch](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/louisruch/32/16291_2.png) [@louisruch](https://discuss.hashicorp.com/u/louisruch)\ **Post date:** [July 23, 2021, 4:26pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/7 "2021-07-23T16:26:40Z")
Hey @ghardak The `403` seems to indicate @mgaffney was on the correct track. It would be interesting to see the results from manually attempting this. ---
**Author:** ![Lev1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/lev1/32/16350_2.png) [@Lev1](https://discuss.hashicorp.com/u/Lev1)\ **Post date:** [November 19, 2021, 4:49pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/8 "2021-11-19T16:49:53Z")
Having similar issue. Trying to connect boundary to HCP vault. Specified admin namespace as a flag but I get permission denied. Manually I get a response that is not permission denied. ---
**Author:** ![grantorchard1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/grantorchard1/32/17626_2.png) [@grantorchard1](https://discuss.hashicorp.com/u/grantorchard1)\ **Post date:** [November 23, 2021, 1:56am UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/9 "2021-11-23T01:56:47Z")
Which build are you on @Lev1? This was [an issue](https://github.com/hashicorp/boundary/issues/1597) that got fixed in the 0.7 release. Cheers, Grant ---
**Author:** ![akhila98](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/akhila98/32/28107_2.png) [@akhila98](https://discuss.hashicorp.com/u/akhila98)\ **Post date:** [May 13, 2022, 1:25pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/10 "2022-05-13T13:25:55Z")
Facing this issue when trying to connect to boundary through vault Error from controller when performing authorize-session on a session against target Error information: Kind: Internal Message: targets.(Service).AuthorizeSession: vault.(Repository).Issue: vault.(client).get: vault:external system issue: error #3014: Error making API request. URL: GET Code: 403. Errors: - 1 error occurred: - permission denied Status: 500 context: Error from controller when performing authorize-session on a session against target ---
**Author:** ![omkensey](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/omkensey/32/40882_2.png) [@omkensey](https://discuss.hashicorp.com/u/omkensey)\ **Post date:** [May 13, 2022, 10:19pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/11 "2022-05-13T22:19:48Z")
This looks like a permission error – does the Vault token you created for Boundary have policies associated with it that allow Boundary to read the secrets it needs to? ---
**Author:** ![akhila98](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/akhila98/32/28107_2.png) [@akhila98](https://discuss.hashicorp.com/u/akhila98)\ **Post date:** [May 16, 2022, 4:47am UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/12 "2022-05-16T04:47:14Z")
path “auth/token/lookup-self” { capabilities = [“read”] } path “auth/token/renew-self” { capabilities = [“update”] } path “auth/token/revoke-self” { capabilities = [“update”] } path “sys/leases/renew” { capabilities = [“update”] } path “sys/leases/revoke” { capabilities = [“update”] } path “sys/capabilities-self” { capabilities = [“update”] } These are the boundary policies ---
**Author:** ![akhila98](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/akhila98/32/28107_2.png) [@akhila98](https://discuss.hashicorp.com/u/akhila98)\ **Post date:** [May 16, 2022, 12:08pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/14 "2022-05-16T12:08:25Z")
Got it resolved. Thanks @omkensey 👍 ---
**Author:** ![akhila98](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/akhila98/32/28107_2.png) [@akhila98](https://discuss.hashicorp.com/u/akhila98)\ **Post date:** [May 30, 2022, 9:52am UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/15 "2022-05-30T09:52:09Z")
Hey @omkensey @louisruch Trying to integrate vault with boundary credential store for AWS ec2 instance ./boundary connect ssh -target-id ttcp\_1234567890 -addr=http://XXXXXXXXXXX -username hello Credentials: Credential Source ID: clvlt\_jnEOdYQyew Credential Source Name: new ec2 Credential Store ID: csvlt\_4lWBv8Wke7 Credential Store Type: vault Secret: username:hello password:hello123 hello@hst\_1234567890’s password: My goal is to use the credentials stored in Vault in order to hide them from the user and connect automatically to the instance,but still I have to pass it manually, the documentation has the analyst role able to connect postgres db without providing the credential. ---
**Author:** ![louisruch](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/louisruch/32/16291_2.png) [@louisruch](https://discuss.hashicorp.com/u/louisruch)\ **Post date:** [May 31, 2022, 10:12pm UTC](https://discuss.hashicorp.com/t/vault-credential-setup/27165/16 "2022-05-31T22:12:51Z")
Hi @akhila98 Currently all credentials are passed directly back to users to be copy and paste into sessions. This workflow is something we are investigating to improve in future Boundary offerings. The auto connect you are describing within the `postgres` command is actually a client side helper that uses the returned creds and passes them through. The end user will still be able to see these credentials by calling the API directly or running `boundary authorize-session -id ttcp_1234567890` This functionality is not currently available for the `ssh` subcommand as most default ssh clients do not allow the password to be provided as a flag. We could look at potentially using something like `sshpass`, but the users will still be able to see these credentials if they wanted.