> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/virtual-hsm/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/virtual-hsm/cli/secret-management/vhsm-secrets/vhsm-secrets-enable.md).

# vhsm secrets enable

This command enables a secrets engine at a given path. If a secrets engine already exists at the specified path, an error appears. After enabling the engine, additional configuration is usually required, which varies based on the engine type.

By default, secrets engines are enabled at a path corresponding to their `TYPE`, but users can customize this using the `-path` option.

{% hint style="info" %}
**Note**:

* Some secrets engines persist data, some act as a data pass-through, and others generate dynamic credentials.
* For specific configuration options, refer to the secrets engine documentation.
  {% endhint %}

### **Case sensitivity**

The path where secrets engines are enabled is case-sensitive.\
For example:

* Enabling a KV secrets engine at `kv/` and `KV/` creates two distinct instances of KV secrets engines.

### **Usage**

```sh
vhsm secrets enable [options] <type>
```

### **Examples**

Enable the AWS secrets engine at `aws/`

```sh
vhsm secrets enable aws
```

**Output**

```
Success! Enabled the AWS secrets engine at: aws/
```

* Enable the SSH secrets engine at a custom path (`ssh-prod/`)

  ```sh
  vhsm secrets enable -path=ssh-prod ssh
  ```
* Enable the database secrets engine with a maximum TTL of 30m

  ```sh
  vhsm secrets enable -max-lease-ttl=30m database
  ```
* Enable a custom plugin (`my-plugin`) after registration

  ```sh
  vhsm secrets enable -path=my-secrets my-plugin
  ```

### **Available Options**

| Option                                   | Description                                                                                                             |
| ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| `-audit-non-hmac-request-keys=<string>`  | Keys **not** HMAC'd by audit devices in the request data. Can be specified multiple times.                              |
| `-audit-non-hmac-response-keys=<string>` | Keys **not** HMAC'd by audit devices in the response data. Can be specified multiple times.                             |
| `-default-lease-ttl=<duration>`          | Default lease TTL for the secrets engine. Uses vHSM server's default if unspecified.                                    |
| `-description=<string>`                  | Human-readable description of the secrets engine.                                                                       |
| `-force-no-cache`                        | Disables caching for the secrets engine. Defaults to vHSM's global settings.                                            |
| `-local`                                 | Marks the secrets engine as **local-only** (not replicated).                                                            |
| `-max-lease-ttl=<duration>`              | Maximum lease TTL for the secrets engine. Uses vHSM’s max TTL if unspecified.                                           |
| `-path=<string>`                         | Custom path where the secrets engine is accessible. Defaults to the `type` of the engine. **Paths are case-sensitive.** |
| `-passthrough-request-headers=<string>`  | Request headers passed to the secrets engine. Can be specified multiple times.                                          |
| `-allowed-response-headers=<string>`     | Response headers the secrets engine is **allowed** to set. Can be specified multiple times.                             |
| `-allowed-managed-keys=<string>`         | Managed key names the mount can access. Can be a comma-separated list or specified multiple times.                      |
| `-plugin-version=<string>`               | Specifies the plugin's semantic version to use. Defaults to built-in or unversioned plugin.                             |