# Storing HashiCorp Vault token used by Percona keyring\_vault
**URL:** https://forums.percona.com/t/storing-hashicorp-vault-token-used-by-percona-keyring-vault/16063
**Category:** Percona Server for MySQL 8.0
**Created:** [June 9, 2022, 11:11pm UTC](https://forums.percona.com/t/storing-hashicorp-vault-token-used-by-percona-keyring-vault/16063 "2022-06-09T23:11:21Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@LukeYangJMA](https://forums.percona.com/u/LukeYangJMA)
#### Post date: [June 9, 2022, 11:11pm UTC](https://forums.percona.com/t/storing-hashicorp-vault-token-used-by-percona-keyring-vault/16063/1 "2022-06-09T23:11:21Z")
We are currently using Percona keyring\_vault to enable TDE on the database while storing the encryption key in HashiCorp Vault. According to the [keyring\_vault documentation](https://www.percona.com/doc/percona-server/8.0/security/using-keyring-plugin.html), one will need to generate a token in Vault set with specific policies and place it within the token parameter of keyring\_vault.conf.
First question: Since the token is stored in a file directly on the server, is restricting the access of the configuration file to the mysql user (using chown) sufficient in terms of security? If someone were to take a copy of the hard disk, it is possible that they could have access to the token and, thus, decrypt the data stored in Percona.
Second question: What is the best practice when providing tokens generated from HashiCorp Vault to Percona? According to [this blog post in 2018](https://www.percona.com/blog/2018/09/17/using-the-keyring_vault-plugin-with-percona-server-for-mysql-5-7/), a token is generated manually in HashiCorp Vault. However, HashiCorp seems to suggest [using an authentication to verify a client](https://learn.hashicorp.com/collections/vault/auth-methods) which then allows a token to be generated.
---
### Author:  [@matthewb](https://forums.percona.com/u/matthewb)
#### Post date: [June 10, 2022, 2:52pm UTC](https://forums.percona.com/t/storing-hashicorp-vault-token-used-by-percona-keyring-vault/16063/2 "2022-06-10T14:52:30Z")
> [@LukeYangJMA](#):
>
> If someone were to take a copy of the hard disk, it is possible that they could have access to the token
They would have access to the token only, not the decryption key. The token simply allows the keyring\_vault plugin to talk to Vault. The key is fetched from Vault using the token and is never stored on disk.
Provided the policies on Vault are up to standard, someone with the token from another machine would not be able to fetch the encryption key and read your data. If you discover a data breach, you can revoke the token as well on the Vault side.
---
### Author:  [@LukeYangJMA](https://forums.percona.com/u/LukeYangJMA)
#### Post date: [June 10, 2022, 3:33pm UTC](https://forums.percona.com/t/storing-hashicorp-vault-token-used-by-percona-keyring-vault/16063/3 "2022-06-10T15:33:29Z")
Thanks for your quick response @matthewb,
> [@matthewb](#):
>
> Provided the policies on Vault are up to standard, someone with the token from another machine would not be able to fetch the encryption key and read your data.
I’m assuming that you might be referring to an authentication method such as [AppRole](https://www.vaultproject.io/api-docs/auth/approle#create-update-approle), which can restrict IP addresses that are allowed to log in using the role\_id (secret\_id\_bound\_cidrs) and use tokens to access vault (token\_bound\_cidrs)?