Prerequisites

HashiCorp Vault Prerequisites

Complete these steps in your Vault environment before configuring the integration in Prizm. You need admin-level access to Vault and the Vault CLI (vault) configured and authenticated.

What you need

A HashiCorp Vault instance (HCP Cloud or self-hosted) reachable from your Prizm environment over the network
Admin-level access to Vault to enable auth methods and write policies
The Vault CLI (vault) configured and authenticated, or access to the Vault UI

Step 1 — Enable App Role authentication

If App Role is not already enabled, run:

vault auth enable approle

Verify it is active:

vault auth list
# approle/ should appear in the list

Step 2 — Create a policy granting secret read access

Create a policy file named prizm-policy.hcl that grants Prizm read access to the paths where your connector secrets are stored:

path "secret/data/prizm/*" {
  capabilities = ["read"]
}

Adjust the path prefix to match where your connector secrets live (e.g., kv/data/prizm/* if using a custom KV mount). Write the policy to Vault:

vault policy write prizm-policy prizm-policy.hcl

Verify the policy was written:

vault policy read prizm-policy

Step 3 — Create the App Role

Create an App Role bound to the policy from Step 2:

vault write auth/approle/role/prizm-role \
  token_policies="prizm-policy" \
  token_ttl=1h \
  token_max_ttl=4h

token_ttl controls how long each Vault token Prizm receives is valid. Prizm re-authenticates automatically when the token expires.

Step 4 — Retrieve the Role ID and generate a Secret ID

Retrieve the Role ID — this is a static identifier for the App Role:

vault read auth/approle/role/prizm-role/role-id
# Output: role_id = <ROLE_ID>

Generate a Secret ID — this acts as a password for the App Role:

vault write -f auth/approle/role/prizm-role/secret-id
# Output: secret_id = <SECRET_ID>

Copy both values. The Secret ID is shown only once and cannot be retrieved again. If you lose it, generate a new one with the same command.

Secret IDs can be set to expire. Use secret_id_ttl on the role (e.g., secret_id_ttl=720h) to automatically invalidate them after a period. Rotate Secret IDs regularly and update the value in Prizm before the old one expires.

Step 5 — Store connector secrets in Vault

If you have not already stored your connector credentials in Vault, do so now. Example for a Snowflake password:

vault kv put secret/prizm/snowflake-prod \
  password="<SNOWFLAKE_PASSWORD>"

The path (secret/prizm/snowflake-prod) and key name (password) are what you will reference when configuring connectors in Prizm.

Summary — values needed for Prizm

Value	How to obtain
Vault Address	The URL of your Vault instance (e.g., `https://vault.yourcompany.com:8200`)
Role ID	Output of `vault read auth/approle/role/prizm-role/role-id`
Secret ID	Output of `vault write -f auth/approle/role/prizm-role/secret-id`
Namespace	Your Vault Enterprise namespace (if applicable; leave blank for community Vault)

Setup

Enter the above values in Prizm to complete the integration.

Get Started

Core Concepts

Platform

Architecture

Data Sources

Integrations

Security & Access Control

Deployment

Help

Settings

MCP

Release Notes

API Reference

HashiCorp Vault Prerequisites

What you need

Step 1 — Enable App Role authentication

Step 2 — Create a policy granting secret read access

Step 3 — Create the App Role

Step 4 — Retrieve the Role ID and generate a Secret ID

Step 5 — Store connector secrets in Vault

Summary — values needed for Prizm

Setup

​HashiCorp Vault Prerequisites

​What you need

​Step 1 — Enable App Role authentication

​Step 2 — Create a policy granting secret read access

​Step 3 — Create the App Role

​Step 4 — Retrieve the Role ID and generate a Secret ID

​Step 5 — Store connector secrets in Vault

​Summary — values needed for Prizm

Setup

HashiCorp Vault Prerequisites

What you need

Step 1 — Enable App Role authentication

Step 2 — Create a policy granting secret read access

Step 3 — Create the App Role

Step 4 — Retrieve the Role ID and generate a Secret ID

Step 5 — Store connector secrets in Vault

Summary — values needed for Prizm