Redis database plugin HTTP API

The Redis database plugin is one of the supported plugins for the database secrets engine. This plugin generates database credentials dynamically based on configured roles for the Redis database.

Configure connection

In addition to the parameters defined by the Database Secrets Engine, this plugin has a number of parameters to further configure a connection.

Method	Path
POST	/database/config/:name

Parameters

• host (string: <required>) – Specifies the host to connect to.

• port (int: <required>) – Specifies the port number of the connection.

• username (string: <required>) – Specifies the username for Vault to use.

• password (string: <required>) – Specifies the password corresponding to the given username.

• tls (bool: false) – Specifies whether to use TLS when connecting to Redis.

• insecure_tls (bool: false) – Specifies whether to skip verification of the server certificate when using TLS.

Sample payload

{
  "plugin_name": "redis-database-plugin",
  "host": "localhost://127.0.0.1",
  "username": "user",
  "password": "pass",
  "allowed-roles": "my-*-role"
}

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/database/config/redis

Statements

Statements are configured during role creation and are used by the plugin to determine what is sent to the database on user creation, renewing, and revocation. For more information on configuring roles see the Role API in the database secrets engine docs.

Parameters

The following are the statements used by this plugin. If not mentioned in this list the plugin does not support that statement type.

• creation_statements (list: []) – Specifies a JSON string containing Redis ACL rules to assign to created users. If not provided, defaults to a read-only user that can read any key.