HashiCorp Vault Associate Vault Identity and Entities 2 — Questions and Answers
Question 1: Can a single Vault entity have more than one alias?
- No, each entity is limited to exactly one alias per Vault cluster
- Yes, an entity can have one alias per auth method mount, allowing a single identity across multiple login methods (Correct answer)
- Yes, but only if the entity belongs to at least one internal group
- No, multiple aliases require creating separate entities that are then merged
Correct answer: Yes, an entity can have one alias per auth method mount, allowing a single identity across multiple login methods
A Vault entity can have multiple aliases, one per auth method mount, representing the same person logging in through different authentication providers.
Question 2: What API path is used to create or manage Vault entities via the HTTP API?
- sys/identity/entity
- identity/entity (Correct answer)
- auth/identity/entity
- secret/identity/entity
Correct answer: identity/entity
The Identity secrets engine is accessed at the 'identity/' path prefix, so entity management operations are performed at 'identity/entity'.
Question 3: What happens to an entity's aliases when the auth method mount they belong to is disabled?
- The aliases are automatically transferred to the default auth mount
- The aliases are deleted, but the entity itself remains intact (Correct answer)
- Both the entity and its aliases are permanently deleted
- The aliases are preserved and reassigned to the nearest enabled auth mount
Correct answer: The aliases are deleted, but the entity itself remains intact
Disabling an auth method mount removes the aliases tied to that mount, but the entity persists with any remaining aliases and its attached policies.
Question 4: How can an operator manually merge two Vault entities that represent the same real user?
- By using the 'vault operator merge-entity' CLI command
- By sending a POST request to 'identity/entity/merge' specifying the source and destination entity IDs (Correct answer)
- By deleting one entity and reassigning its aliases to the other via the auth method config
- By editing the Vault storage backend directly to combine the entity records
Correct answer: By sending a POST request to 'identity/entity/merge' specifying the source and destination entity IDs
Vault exposes the 'identity/entity/merge' API endpoint that accepts source entity IDs and a destination entity ID to combine duplicate identity records.
Question 5: Which field on a Vault entity is most useful for storing human-readable metadata like department or team?
- entity.labels
- entity.metadata (Correct answer)
- entity.tags
- entity.annotations
Correct answer: entity.metadata
Vault entities support a 'metadata' key-value map that operators can populate with arbitrary data like department, team, or cost center for policy templating or audit purposes.
Question 6: How do entity aliases interact with policy templating in Vault?
- Aliases cannot be referenced in policy templates; only group membership can be
- Policy templates can reference entity metadata and alias name using double-curly-bracket syntax (Correct answer)
- Policy templating only works with tokens, not with identity entities
- Aliases are hashed before use in templates to prevent information leakage
Correct answer: Policy templates can reference entity metadata and alias name using double-curly-bracket syntax
Vault's policy templating engine supports referencing identity data such as 'identity.entity.metadata.<key>' and 'identity.entity.aliases.<mount_accessor>.name' within policy path strings.
Question 7: When a token is created using the 'token create' command with no associated entity, how does Vault treat its identity?
- Vault automatically creates a new entity for every token regardless of how it was created
- The token has no associated entity and thus no entity policies apply (Correct answer)
- The token inherits the entity of the creating token automatically
- Vault assigns the token to a built-in anonymous entity
Correct answer: The token has no associated entity and thus no entity policies apply
Tokens created directly (not via an auth method login) are not automatically linked to an entity, so no entity-level policies are included in their policy set.
HashiCorp Vault Associate Vault Identity and Entities 2
Can a single Vault entity have more than one alias?