> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Prerequisites

> HashiCorp Vault configuration required before connecting to Prizm — App Role setup, policy, and secret storage.

<script type="application/ld+json">
  {`{
            "@context": "https://schema.org",
            "@type": "TechArticle",
            "headline": "HashiCorp Vault Prerequisites",
            "description": "HashiCorp Vault configuration required before connecting to Prizm - App Role setup, policy, and secret storage.",
            "url": "https://docs.dqlabs.ai/integrations/hashicorp-vault/prerequisites",
            "publisher": {
              "@type": "Organization",
              "name": "DQLabs Inc",
              "logo": "https://media.brand.dev/332adc35-5bc4-4d2b-bf78-256aa4a5e414.svg"
            }
            }`}
</script>

## HashiCorp Vault Prerequisites

Complete these steps in your Vault environment before configuring the integration in Prizm. You need admin-level access to Vault and the Vault CLI (`vault`) configured and authenticated.

### What you need

* A HashiCorp Vault instance (HCP Cloud or self-hosted) reachable from your Prizm environment over the network
* Admin-level access to Vault to enable auth methods and write policies
* The Vault CLI (`vault`) configured and authenticated, or access to the Vault UI

***

## Step 1 — Enable App Role authentication

If App Role is not already enabled, run:

```shell theme={null}
vault auth enable approle
```

Verify it is active:

```shell theme={null}
vault auth list
# approle/ should appear in the list
```

***

## Step 2 — Create a policy granting secret read access

Create a policy file named `prizm-policy.hcl` that grants Prizm read access to the paths where your connector secrets are stored:

```hcl theme={null}
path "secret/data/prizm/*" {
  capabilities = ["read"]
}
```

Adjust the path prefix to match where your connector secrets live (e.g., `kv/data/prizm/*` if using a custom KV mount). Write the policy to Vault:

```shell theme={null}
vault policy write prizm-policy prizm-policy.hcl
```

Verify the policy was written:

```shell theme={null}
vault policy read prizm-policy
```

***

## Step 3 — Create the App Role

Create an App Role bound to the policy from Step 2:

```shell theme={null}
vault write auth/approle/role/prizm-role \
  token_policies="prizm-policy" \
  token_ttl=1h \
  token_max_ttl=4h
```

`token_ttl` controls how long each Vault token Prizm receives is valid. Prizm re-authenticates automatically when the token expires.

***

## Step 4 — Retrieve the Role ID and generate a Secret ID

Retrieve the Role ID — this is a static identifier for the App Role:

```shell theme={null}
vault read auth/approle/role/prizm-role/role-id
# Output: role_id = <ROLE_ID>
```

Generate a Secret ID — this acts as a password for the App Role:

```shell theme={null}
vault write -f auth/approle/role/prizm-role/secret-id
# Output: secret_id = <SECRET_ID>
```

Copy both values. The Secret ID is shown only once and cannot be retrieved again. If you lose it, generate a new one with the same command.

<Note>
  Secret IDs can be set to expire. Use `secret_id_ttl` on the role (e.g., `secret_id_ttl=720h`) to automatically invalidate them after a period. Rotate Secret IDs regularly and update the value in Prizm before the old one expires.
</Note>

***

## Step 5 — Store connector secrets in Vault

If you have not already stored your connector credentials in Vault, do so now. Example for a Snowflake password:

```shell theme={null}
vault kv put secret/prizm/snowflake-prod \
  password="<SNOWFLAKE_PASSWORD>"
```

The path (`secret/prizm/snowflake-prod`) and key name (`password`) are what you will reference when configuring connectors in Prizm.

***

## Summary — values needed for Prizm

| Value             | How to obtain                                                                    |
| ----------------- | -------------------------------------------------------------------------------- |
| **Vault Address** | The URL of your Vault instance (e.g., `https://vault.yourcompany.com:8200`)      |
| **Role ID**       | Output of `vault read auth/approle/role/prizm-role/role-id`                      |
| **Secret ID**     | Output of `vault write -f auth/approle/role/prizm-role/secret-id`                |
| **Namespace**     | Your Vault Enterprise namespace (if applicable; leave blank for community Vault) |

<Card title="Setup" icon="gear" href="/integrations/hashicorp-vault/setup">
  Enter the above values in Prizm to complete the integration.
</Card>