What will happen if I update the secret in Vault and use the wrap function?

When updating a secret in Vault and using the Wrap function, the following occurs:

1. A new secret with the updated value is created inside Vault.
2. A new one-time token (Wrapping Token) is generated. This token encapsulates the new secret.
3. The original secret (before the update) remains unchanged until it is deactivated or deleted according to Vault policies or explicit action.
4. When attempting to "unwrap" the generated Wrapping Token with another Vault client, this client gains access to the new, updated secret value.
5. After a successful "unwrap", the Wrapping Token becomes invalid and cannot be reused. This guarantees that the Wrapped secret can only be retrieved once through this token.
6. The Wrapped secret is stored in a separate storage within Vault, isolated from the main secret storage, until it is unwrapped.

Thus, the wrap function does not change the secret update process but provides a secure, one-time method to deliver this updated secret to the recipient using a Wrapping Token.

Example command to update a secret using wrap:

# Assuming you already have a secret at path secret/myapp/config
# Updating secret data and wrapping it in a token
vault write -wrap-ttl=5m secret/myapp/config \
  username="new_user" \
  password="new_password"

The output of this command will contain a Wrapping Token that should be passed to the recipient:

// Example output of the above command
{
  "request_id": "...",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": null,
  "wrap_info": {
    "token": "hvs.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", // This token contains the updated secret
    "accessor": "...",
    "ttl": 300, // Life span of the wrapping token (5 minutes)
    "creation_time": "...",
    "wrapped_accessor": "..."
  },
  "auth": null
}

The recipient then uses this token to retrieve the updated secret (unwrap):

# Using the Wrapping Token to get the updated secret
vault unwrap hvs.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The result of the unwrap will show the new secret data:

// Example output of the unwrap command
{
  "request_id": "...",
  "lease_id": "",
  "renewable": false,
  "lease_duration": 0,
  "data": {
    "username": "new_user",
    "password": "new_password"
  },
  "wrap_info": null,
  "auth": null
}