vault transit: Encryption as a Service
The transit engine encrypts and decrypts data with keys that never leave Vault, returning a versioned ciphertext.
transit gives CI encryption without holding key material: send plaintext, get back ciphertext, and decrypt later. The plaintext must be base64 and the ciphertext carries a key version prefix.
What it does
The transit secrets engine performs cryptographic operations on data using named keys stored in Vault. transit/encrypt/<key> takes base64 plaintext and returns ciphertext like vault:v1:...; transit/decrypt/<key> reverses it. Keys can be rotated, and old ciphertexts still decrypt with min_decryption_version honored.
Common usage
vault secrets enable transit
vault write -f transit/keys/ci
# encrypt (plaintext must be base64)
CT=$(vault write -field=ciphertext transit/encrypt/ci \
plaintext=$(echo -n "s3cr3t" | base64))
# decrypt back to plaintext
vault write -field=plaintext transit/decrypt/ci ciphertext="$CT" | base64 -dOptions
| Path / field | What it does |
|---|---|
| transit/keys/<name> | Create or read a named encryption key |
| transit/encrypt/<name> | Encrypt base64 plaintext, returns ciphertext |
| transit/decrypt/<name> | Decrypt ciphertext, returns base64 plaintext |
| transit/keys/<name>/rotate | Rotate to a new key version |
| transit/rewrap/<name> | Re-encrypt old ciphertext to the latest version |
In CI
transit is handy for encrypting a value into a repo or artifact and decrypting it only in the pipeline, without the pipeline ever seeing the key. Remember plaintext is base64 on the way in and base64 on the way out: base64 to send, base64 -d to read. After rotating, use rewrap to upgrade stored ciphertexts.
Common errors in CI
"invalid request" on encrypt usually means the plaintext was not base64; transit requires it. "ciphertext or signature version is disallowed by policy (too old)" means the key version is below min_decryption_version. "encryption key not found" means the named key was never created with transit/keys/<name>. "permission denied" means the policy lacks update on transit/encrypt/<name>.