explore recursively your vault by HashiCorp

vault-tree

#!/usr/bin/env bash

function walk() {
  for secret in $(vault list $1 | tail -n +3)
  do
    if [[ ${secret} == *"/" ]] ; then
      walk "${1}${secret}"
    else
      echo "${1}${secret}"
    fi
  done
}

query="${1}"

if [[ ${query} != *"/" ]] ; then
  query=${query}/
fi

echo "${1}"
walk ${query}

vault read -format=json sys/mounts | jq -r '.data | with_entries(select(.value.type=="kv")) | map_values(.type)'
#
vault read -format=json sys/mounts | jq -r '.data | with_entries(select(.key|match("secret"))) | map_values(.options)'

# same for secrets
vault read -format=json sys/mounts | jq -r '.data | with_entries(select(.value.type=="aws")) | map_values(.type)'
# same for auth
vault read -format=json sys/auth | jq -r '.data | with_entries(select(.value.type=="aws")) | map_values(.type)'

# get all AWS access-keys associated with Vault AWS secrets
for item in $(vault read -format=json sys/mounts | jq -r '.data | with_entries(select(.value.type=="aws")) | keys[]'); do
  vault read -format=json $item/config/root | jq -r '.data.access_key'
done

# get all AWS access-keys associated with Vault AWS auth
for item in $(vault read -format=json sys/auth | jq -r '.data | with_entries(select(.value.type=="aws")) | keys[]'); do
  vault read -format=json auth/$item/config/client | jq -r '.data.access_key'
done