Skip to main content

​
What is the HashiCorp Vault integration?

The HashiCorp Vault integration connects Prizm to HashiCorp Vault using the App Role authentication method, enabling Prizm to retrieve connector credentials — passwords, API tokens, connection strings — directly from Vault at runtime. Credentials are never stored in Prizm; they are fetched from Vault each time a connector needs to establish a connection. This allows organizations with a centralized secrets management practice to extend that practice to their data quality platform.

​
What this integration enables

​
Using HashiCorp Vault with Prizm

Once the HashiCorp Vault integration is active, it becomes available as a credential source when creating or editing connectors in Prizm. Instead of entering a password or API token directly, you select the Vault integration and specify where in Vault the credential lives. Prizm fetches it at runtime and does not cache it. When creating or editing a connector — for example, a Snowflake or PostgreSQL connector — locate the Credentials section. Instead of entering a password directly, click Use Vault and select the HashiCorp Vault integration you configured. Enter the secret key name within the Vault path (for example, if the secret at secret/data/prizm/snowflake-prod contains a field named password, enter password as the key). Save the connector. Prizm retrieves the credential from Vault each time the connector establishes a connection.
Connector configuration form showing the Use Vault option selected in the Credentials section with a secret key field

​
How credential retrieval works at runtime

When Prizm needs to connect to a data source through a Vault-backed connector, it authenticates with Vault using the configured Role ID and Secret ID to obtain a short-lived Vault token. It then reads the secret at the configured path and extracts the specified key. The retrieved credential is used for the connection and is not stored anywhere in Prizm after the connection is established.

​
Credential rotation

When a credential is rotated in Vault, update the secret value at the same Vault path and key. No changes are needed in Prizm. The next time the connector establishes a connection, Prizm fetches the new credential from Vault automatically, making Vault-backed connectors fully compatible with automated credential rotation policies.
Diagram showing the flow from Prizm connector to Vault App Role authentication to secret retrieval
Use separate Vault paths for each environment (e.g., secret/data/prizm/snowflake-prod and secret/data/prizm/snowflake-staging) and create separate App Role policies scoped to each path. This limits the blast radius if a Secret ID is ever compromised — the integration can only read secrets in its own environment’s path.

Setup

Connect HashiCorp Vault to Prizm — step-by-step configuration guide.