The vault and privileged account credentials

Privileged account credentials live in a vault. They are "write-only": an administrator sets them, but no page ever shows them again.

How do I set a credential?

1. On the target, open the account and choose «Set credential».
2. Paste the secret in «New secret» (up to 16 KiB).
3. Save. «The credential was stored. It is never shown again.» appears.

«The secret is sealed in the vault and is never shown again. Each change creates a new version.» Setting a credential schedules a check on the target.

Versions

The «Versions» section lists each version with its state: «Current», «Previous», «Pending», «Failed» or «Retired». A rotation creates a «Pending» version that becomes «Current» when the target confirms.

How is it protected?

• Each version is encrypted with an organization key of a numbered generation.
• That key is protected by a key in the key management service (KMS).
• Optionally, each generation is also sealed to a key your organization keeps offline. See Key escrow.

Who sees the password?

Nobody, except a person with a «Credential checkout» lease whose profile allows «Allow revealing the credential». The reveal lasts 30 seconds and requires rotation on check-in.

The vault does not answer

A message that the vault is unavailable means the key service did not answer. If it persists, contact support.