Hashicorp vault - export key from one vault, import into another vault - hashicorp-vault

Question

I'd like to export a key from one vault, and import it into another vault.
It feels there should be an easy way to do this from the command line, but I don't see an abstract simple way to do it, to fully export, then import a key.
Is there anyway to do this? I would prefer command line solutions, using the vault script.

Answer 1

The only way to do that is by chaining two vault commands, which is effectively reading the value out of the first vault and then writing it to the second one. For example:
export VAULT_TOKEN=valid-token-for1
export VAULT_ADDR=https://vault1
JSON_DATA=$(vault kv get -format json -field data secret/foo)
export VAULT_TOKEN=valid-token-for2
export VAULT_ADDR=https://vault2
echo $JSON_DATA | vault kv put secret/foo -

Answer 2

We are developing a open source cli tool that does exactly what you need.
The tool can handle one secret or a full tree structure in both import and export. It also supports end to end encryption of your secrets between export and import between Vault instances.
https://github.com/jonasvinther/medusa
export VAULT_ADDR=https://192.168.86.41:8201
export VAULT_SKIP_VERIFY=true
export VAULT_TOKEN=00000000-0000-0000-0000-000000000000
./medusa export kv/path/to/secret --format="yaml" --output="my-secrets.txt"
./medusa import kv/path/to/new/secret ./my-secrets.txt

Answer 3

The only way to export data from one vault to another is by doing it individually for every key (and every path). I've written a small bash script to automate this for all keys in a given path.
This script polls the data for each key (for the given path) from the source vault and inserts it into the destination vault.
You need to provide the vault url, token and CA certificate (for https authentication) for source and destination vaults & also the path (which has the keys) in the script below -
#! /usr/bin/env bash
source_vault_url="<source-vault-url>"
source_vault_token="<source_vault_token>"
source_vault_cert_path="<source_vault_cert_path>"
destination_vault_url="<destination_vault_url>"
destination_vault_token="<destination_vault_token>"
destination_vault_cert_path="<destination_vault_cert_path>"
# secret_path is the path from which the keys are to be exported from source vault to destination vault
secret_path="<path-without-slash>"
function _set_source_vault_env_variables() {
export VAULT_ADDR=${source_vault_url}
export VAULT_TOKEN=${source_vault_token}
export VAULT_CACERT=${source_vault_cert_path}
}
function _set_destination_vault_env_variables() {
export VAULT_ADDR=${destination_vault_url}
export VAULT_TOKEN=${destination_vault_token}
export VAULT_CACERT=${destination_vault_cert_path}
}
_set_destination_vault_env_variables
printf "Enabling kv-v2 secret at the path ${secret_path} in the destination vault -\n"
vault secrets enable -path=${secret_path}/ kv-v2 || true
_set_source_vault_env_variables
# getting all the keys in the given path from source vault
keys=$(vault kv list ${secret_path}/ | sed '1,2d')
# iterating though each key in source vault (in the given path) and inserting the same into destination vault
printf "Exporting keys from source vault ${source_vault_url} at path ${secret_path}/ ... \n"
for key in ${keys}
do
_set_source_vault_env_variables
key_data_json=$(vault kv get -format json -field data ${secret_path}/${key})
printf "${key} ${key_data_json}\n"
_set_destination_vault_env_variables
echo ${key_data_json} | vault kv put ${secret_path}/${key} -
done
printf "Export Complete!\n"
# listing all the keys (in the given path) in the destination vault
printf "Keys in the destination vault ${destination_vault_url} at path ${secret_path}/ -\n"
vault kv list ${secret_path}