-
Notifications
You must be signed in to change notification settings - Fork 4.5k
Open
Description
Describe the bug
When I'm fetching a transit key details via vault read or API directly, there's no info when a certain version of the key was created.
For example, for aes256-gcm96 it's returned in data.keys as a map of <version>:<unix_timestamp>, example from docs.
I wonder if it would be possible to introduce it for a hmac key as well as it simplifies debugging.
Response example:
vault read -format=json transit/keys/test-key
{
"request_id": "893ab392-724e-d1b2-05d1-768d823da01f",
"lease_id": "",
"lease_duration": 0,
"renewable": false,
"data": {
"allow_plaintext_backup": false,
"auto_rotate_period": 3600,
"deletion_allowed": false,
"derived": false,
"exportable": true,
"imported_key": false,
"key_size": 32,
"latest_version": 3,
"min_available_version": 0,
"min_decryption_version": 1,
"min_encryption_version": 0,
"name": "test-key",
"supports_decryption": false,
"supports_derivation": false,
"supports_encryption": false,
"supports_signing": false,
"type": "hmac"
},
"warnings": null,
"mount_type": "transit"
}To Reproduce
Steps to reproduce the behavior:
- Run
vault secrets enable transitto enable transit secret engine - Run
vault write -f transit/keys/test-key exportable=true type=hmac key_size=32 auto_rotate_period="1h"to create a hmac key - Run
vault write -f transit/keys/test-key/rotateto rotate the key - Run
vault read -format=json transit/keys/test-keyto read the keys
Expected behavior
A map of versions/unix-timestamps (.data.keys) is returned when reading a transit key details, similarly as for other key types:
https://developer.hashicorp.com/vault/api-docs/secret/transit#sample-response-1
Environment:
- Vault Server Version (retrieve with
vault status):
Key Value
--- -----
Seal Type shamir
Initialized true
Sealed false
Total Shares 1
Threshold 1
Version 1.21.1
Build Date 2025-11-18T13:04:32Z
Storage Type inmem
Cluster Name vault-cluster-775a74a8
Cluster ID d7bc840a-1437-cc0a-2906-cf6ba4ef2790
HA Enabled false- Vault CLI Version (retrieve with
vault version):
Vault v1.21.1 (2453aac2638a6ae243341b4e0657fd8aea1cbf18), built 2025-11-18T13:04:32Z