Skip to main content

astroctl integrations vault replace

Replace a self-hosted cluster's stored key with a new one you made

Synopsis​

Replace a self-hosted cluster's stored key with a new one you made. AstroPulse checks the new key against the cluster's cloud account and stores it only when every check passes; the old key stays valid in your account, and the answer says how to delete it there.

The lease ID is the leaseId field of "astroctl integrations vault list -o yaml". Only an organization owner or admin can replace a key. The key is read from a file, an AWS CLI profile or standard input, never from the command line.

Terminal
astroctl integrations vault replace <lease-id> [flags]

Examples​

Terminal

# An AWS key saved as an AWS CLI profile
astroctl integrations vault replace 5891b549-771f-4b2a-99c7-727ccf69f87c --profile prod-rotated

# An AWS key from the CSV file the AWS console downloads, or from 'aws iam create-access-key' output
astroctl integrations vault replace 5891b549-771f-4b2a-99c7-727ccf69f87c --access-key-file new_accessKeys.csv

# A Google Cloud service account key file
astroctl integrations vault replace 5891b549-771f-4b2a-99c7-727ccf69f87c --credentials new-key.json

# Any of those files on standard input
cat new-key.json | astroctl integrations vault replace 5891b549-771f-4b2a-99c7-727ccf69f87c -f -

Options​

Terminal
      --access-key-file string   File holding the new AWS access key: the console's CSV download or 'aws iam create-access-key' JSON output
      --credentials string       Google Cloud service account key file (JSON)
  -f, --file string              File holding the new key in any of those forms; - reads standard input
  -h, --help                     help for replace
      --profile string           AWS CLI profile holding the new access key

Options inherited from parent commands​

Terminal
  -o, --output string   Output format (table|json|yaml) (default "table")

SEE ALSO​