Create a locker for an external key vault connection - Create a locker for an external vault connection to group credentials and control which users and roles can access them.

Create a locker for an external vault connection to group credentials and control which users and roles can access them.

Before you begin

You must have the permissions listed below or AAE_Locker Admin role:
1. 'Manage my credentials and lockers' permission to create a locker.
2. 'View Users and Roles basic information' permission to view information about other users to add them as locker owners/Managers/participants. Without this permission, an "Access denied" error will occur. See RBAC for Credential Vault credentials management.
3. 'View External Vaults' permission to manage lockers.
The external vault connection is configured in Control Room.

Log in to Control Room as a user with the required permissions.
Navigate to Manage > External Vault.
Click Add or + icon to create a new locker.
Enter the Locker name and Description. Description is an optional field.

Note: Ensure that you do not use a locker name starting with oauth_ (case insensitive, for example, OAuth_, oAuth_, and so on) as it is a reserved namespace.
Select the vault you've created on the External Vault page.
Based on the external vault you have selected, do the following and click Next.
- For AWS, enter the Prefix of secrets stored in the locker.
- For CyberArk, enter the Safe name where the CyberArk account with credentials are stored.
- For Azure, enter the Prefix of secrets stored in the locker.
- For HashiCorp, enter the Prefix of secrets stored in the locker.
Note: For BeyondTrust, ARCON and Delinea, you do not see the Prefix of secrets or Safe name options.

Add the Locker owners and click Next.For more information on locker owners, managers, participants, and consumers, refer the table below:


User type	Description
Locker owners	The locker owner can edit, view, and delete a locker and add or remove other locker owners. Note: A locker must have at least one owner.
Locker managers	The locker manager can view, edit and delete the locker, and add participants but cannot add owners or managers to the locker.
Locker participants	A locker participant has access to view a locker and add their own credentials to a locker. They do not have access to, or visibility of credentials created by other users. Also, they will not be able to use their credentials, when running a bot, unless they are also a locker consumer.
Locker consumers	If the locker consumer is user-provided, they can input their information in user-provided credentials with user-provided attributes. If the locker consumer is standard type, they can view the locker and all the credentials inside the locker. All consumers see the same credential value set by the credential owner.

Optional: Add the Locker managers and click Next.
Optional: Add the Locker participants and click Next.
Add the Locker consumers. Select one or more roles. Users with these roles have access to the locker. System-created roles are not shown in the Locker consumers list.
Click Create locker.