// file included in the following:
//
// assembly-record-encryption-filter.adoc

[id='assembly-hashicorp-vault-{context}']
= Setting up HashiCorp Vault

[role="_abstract"]
To use HashiCorp Vault with the Record Encryption filter, use the following setup:

* Enable the Transit Engine as the Record Encryption filter relies on its APIs.
* Create a Vault policy specifically for the filter with permissions for generating and decrypting Data Encryption Keys (DEKs) for envelope encryption.
* Obtain a Vault token that includes the filter policy.

include::../modules/record-encryption/hashicorp-vault/con-vault-setup.adoc[leveloffset=+1]
include::../modules/record-encryption/hashicorp-vault/con-vault-service-config.adoc[leveloffset=+1]
include::../modules/record-encryption/hashicorp-vault/con-vault-key-creation.adoc[leveloffset=+1]