A CLI tool to audit and alert on expiring secrets in HashiCorp Vault.
go install github.com/yourusername/vaultwatch@latestOr download a pre-built binary from the releases page.
Set your Vault address and token, then run an audit:
export VAULT_ADDR="https://vault.example.com"
export VAULT_TOKEN="s.yourtoken"
# Audit all secrets and alert on those expiring within 30 days
vaultwatch audit --path secret/ --warn-within 30d
# Output results as JSON
vaultwatch audit --path secret/ --format json
# Watch continuously and send alerts
vaultwatch watch --path secret/ --interval 1h --alert slack| Flag | Description | Default |
|---|---|---|
--path |
Vault path to audit | secret/ |
--warn-within |
Alert threshold duration | 30d |
--format |
Output format (text, json) |
text |
--interval |
Watch mode poll interval | 1h |
--alert |
Alert backend (slack, pagerduty) |
none |
VaultWatch can be configured via a vaultwatch.yaml file:
vault_addr: https://vault.example.com
warn_within: 30d
alert:
backend: slack
webhook_url: https://hooks.slack.com/services/...- Go 1.21+
- HashiCorp Vault 1.10+
MIT — see LICENSE for details.