cloudtaser-cli target import

Generates a shell script that uses cloud CLI tools (aws, gcloud, az) and the bao CLI to import secrets from a cloud provider secret manager into OpenBao. The imported secrets can then be consumed by workloads via CloudTaser sovereign secret injection.

Supported providers: aws-sm -- AWS Secrets Manager gcp-sm -- GCP Secret Manager azure-kv -- Azure Key Vault

The generated script requires: - The appropriate cloud CLI authenticated (aws, gcloud, or az) - The bao CLI installed (https://github.com/openbao/openbao) - BAO_TOKEN exported when the generated script is executed - jq installed for JSON parsing

Usage

cloudtaser-cli target import [flags]

Examples

# Generate import script for AWS Secrets Manager
  cloudtaser-cli target import --from=aws-sm --secretstore-address https://vault.eu.example.com --region eu-west-1

  # Generate import script and save to file, then provide BAO_TOKEN at execution time
  cloudtaser-cli target import --from=aws-sm --secretstore-address https://vault.eu.example.com > import.sh
  BAO_TOKEN="$(cat /path/to/token)" bash import.sh

  # Dry run -- list secrets without importing
  cloudtaser-cli target import --from=gcp-sm --secretstore-address https://vault.eu.example.com --dry-run

  # Azure Key Vault import with custom prefix
  cloudtaser-cli target import --from=azure-kv --secretstore-address https://vault.eu.example.com --secretstore-name my-kv --prefix secret/azure

Flags

Flag	Type	Default	Required	Description
--dry-run	bool	false	no	list secrets that would be imported without importing
--from	string	(empty)	yes	source provider (aws-sm, gcp-sm, azure-kv)
--help, -h	bool	false	no	help for import
--prefix	string	secret/imported	no	OpenBao KV path prefix
--region	string	(empty)	no	cloud provider region (for aws-sm, gcp-sm)
--resource-group	string	(empty)	no	Azure resource group (for azure-kv)
--secretstore-address	string	(empty)	no	secret store address to import into (env: CLOUDTASER_SECRETSTORE_ADDRESS, VAULT_ADDR)
--secretstore-name	string	(empty)	no	secret store name
--secretstore-token	string	(empty)	no	secret store token (prefer --secretstore-token-file or SECRETSTORE_TOKEN to avoid process-list exposure)
--secretstore-token-file	string	(empty)	no	path to a file containing the secret store token, or '-' to read it from stdin
--timeout	duration	20m0s	no	maximum time for the command to complete (default 20m0s; also CLOUDTASER_TIMEOUT env)

All commands