# community.hashi\_vault.hashi\_vault lookup plugin getting permission denied constantly

**URL:** <https://forum.ansible.com/t/community-hashi-vault-hashi-vault-lookup-plugin-getting-permission-denied-constantly/43595>\
**Category:** Get Help\
**Created:** [June 27, 2025, 11:29am UTC](https://forum.ansible.com/t/community-hashi-vault-hashi-vault-lookup-plugin-getting-permission-denied-constantly/43595 "2025-06-27T11:29:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ku4eto](https://avatars.discourse-cdn.com/v4/letter/k/d78d45/32.png) [@ku4eto](https://forum.ansible.com/u/ku4eto)\
**Post date:** [June 27, 2025, 11:29am UTC](https://forum.ansible.com/t/community-hashi-vault-hashi-vault-lookup-plugin-getting-permission-denied-constantly/43595/1 "2025-06-27T11:29:26Z")

</div>

Hey folks.

I am using the `community.hashi_vault.hashi_vault` lookup plugin in attempts to get a secret from the HashiCorp vault.

I am issuing a login before all that, and i have a login token set via `client_token: "{{ login_var.login.auth.client_token }}"`.

The lookup looks like the following:

```auto
- name: somename
  debug:
    msg: "Test secret: {{ lookup('community.hashi_vault.hashi_vault', 'path/to/secret:key', mount_point='secrets', token=client_token, url='some_url', validate_certs=false, return_format='values') }} "

```

When run, this throws the following:

```auto
fatal: [test]: FAILED! =>
   msg: 'An unhandled exception occurred while running the lookup plugin ''community.hashi_vault.hashi_vault''. Error was a <class ''ansible.errors.AnsibleError''>, original message: Forbidden: Permission Denied to secret ''redacted/path/to/secret''.. Forbidden: Permission Denied to secret ''redacted/path/to/secret''.'

```

After lots of head banging, i just cant get it to work.

First, turns out, that you need to have the `secrets` path always as first parameter.  
Before that was returning `[]` empty responses.

Vault log shows the same permission denied error.

When testing with a custom written plugin, the same token works, so its not token or permission issues, but more like PATH.

The `hashi_vault` plugin has the following as a comment in the examples, but not actual parameter explanation:

> Blockquote  
> When using KV v2 the PATH should include “data” between the secret engine mount and path (e.g. “secret/data/:path”)  
> see: [KV - Secrets Engines - HTTP API | Vault | HashiCorp Developer](https://www.vaultproject.io/api/secret/kv/kv-v2.html#read-secret-version)

When comparing the successful and failing requests, i can see that indeed the `data/` is missing from the path.  
But… after adding it manually, it simply does not get registered by the Hashicorp Vault.  
It seems like it gets removed from the secret path.

Any ideas on how to do overcome this issue and get via the lookup plugin the secret value?

---

<div class="post-metadata">

**Author:** ![briantist](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/briantist/32/130_2.png) [@briantist](https://forum.ansible.com/u/briantist)\
**Post date:** [June 27, 2025, 2:37pm UTC](https://forum.ansible.com/t/community-hashi-vault-hashi-vault-lookup-plugin-getting-permission-denied-constantly/43595/2 "2025-06-27T14:37:07Z")

</div>

If you’re using kv2, you would be much better served with the `community.hashi_vault.vault_kv2_get` content (lookup or module).

Here are some docs:

- [About the hashi\_vault lookup — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/collections/community/hashi_vault/docsite/about_hashi_vault_lookup.html)
- [Migrating from the hashi\_vault lookup — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/collections/community/hashi_vault/docsite/migration_hashi_vault_lookup.html)
- [https://docs.ansible.com/ansible/latest/collections/community/hashi\_vault/docsite/lookup\_guide.html](https://docs.ansible.com/ansible/latest/collections/community/hashi_vault/docsite/lookup_guide.html)

* * *

As for your question though, most of the [examples for the `hashi_vault` lookup](https://docs.ansible.com/ansible/latest/collections/community/hashi_vault/hashi_vault_lookup.html#examples) do indeed show putting `/data/` in the path.

If you use `vault_kv2_get` you will not need to insert `/data/` between the secret engine and the secret path.

> But… after adding it manually, it simply does not get registered by the Hashicorp Vault.  
> It seems like it gets removed from the secret path.

Could you expand on what this means?

---

<div class="post-metadata">

**Author:** ![ku4eto](https://avatars.discourse-cdn.com/v4/letter/k/d78d45/32.png) [@ku4eto](https://forum.ansible.com/u/ku4eto)\
**Post date:** [June 27, 2025, 3:15pm UTC](https://forum.ansible.com/t/community-hashi-vault-hashi-vault-lookup-plugin-getting-permission-denied-constantly/43595/3 "2025-06-27T15:15:45Z")

</div>

> Could you expand on what this means?

As in, on the Vault logs, where the request is seen to fail, the given `path` is missing `data/ ` in it, only `path/to/secret`. And i do not see a `mount_point` mentioned as well…

I was hoping to manage to get the `hashi_vault` lookup to work, since the currently implemented custom plugin is very close to it to functionality. And the total amount of playbooks that will need rework is big. Unfortunately, does not seem like “the easy way” will work.

---

<div class="post-metadata">

**Author:** ![briantist](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/briantist/32/130_2.png) [@briantist](https://forum.ansible.com/u/briantist)\
**Post date:** [June 27, 2025, 3:51pm UTC](https://forum.ansible.com/t/community-hashi-vault-hashi-vault-lookup-plugin-getting-permission-denied-constantly/43595/4 "2025-06-27T15:51:36Z")

</div>

> [@ku4eto](#):
>
> the currently implemented custom plugin

hard to comment on this without knowing what it does

> [@ku4eto](#):
>
> Unfortunately, does not seem like “the easy way” will work.

The `vault_kv2_get` plugins were written specifically for it, as mentioned in the guides it’s much more straightforward to use. However the `hashi_vault` lookup still works and does auth very similarly. I suspect you have the path wrong.

> [@ku4eto](#):
>
> And i do not see a `mount_point` mentioned as well…

Is this referring to the vault logs or something else?

The `mount_point` option in the collection’s plugins is the mount point for the auth method, which doesn’t apply to token auth. I see in your example you’re trying to set it to the secret engine mount point. That won’t work because the `hashi_vault` lookup is not secret engine aware except implicitly (this is one of the things that make it less than ideal).

If you use `vault_kv2_get` you can set `engine_mount_point` (if needed).

In `hashi_vault` you need to include the engine mount point as part of the path.

You example should probably be:

```yaml
- name: somename
  debug:
    msg: "Test secret: {{ lookup('community.hashi_vault.hashi_vault', 'secrets/data/path/to/secret:key', token=client_token, url='some_url', validate_certs=false, return_format='values') }} "

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [July 27, 2025, 3:51pm UTC](https://forum.ansible.com/t/community-hashi-vault-hashi-vault-lookup-plugin-getting-permission-denied-constantly/43595/5 "2025-07-27T15:51:47Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.