$ vault secrets list
Path          Type         Description
----          ----         -----------
cubbyhole/    cubbyhole    per-token private secret storage
identity/     identity     identity store
secret/       kv           key/value secret storage
sys/          system       system endpoints used for control, policy and debugging

$ vault secrets enable -path=kv kv
Success! Enabled the kv secrets engine at: kv/
$ vault secrets list
Path          Type         Description
----          ----         -----------
cubbyhole/    cubbyhole    per-token private secret storage
identity/     identity     identity store
kv/           kv           n/a
secret/       kv           key/value secret storage
sys/          system       system endpoints used for control, policy and debugging

$ vault write kv/hello target=world
Success! Data written to: kv/hello
$ vault read kv/hello
Key                 Value
---                 -----
refresh_interval    768h
target              world
$ vault read secret/hello
No value found at secret/hello

$ vault secrets disable kv
Success! Disabled the secrets engine (if it existed) at: kv/
$ vault secrets list
Path          Type         Description
----          ----         -----------
cubbyhole/    cubbyhole    per-token private secret storage
identity/     identity     identity store
secret/       kv           key/value secret storage
sys/          system       system endpoints used for control, policy and debugging

$ vault secrets enable -path=aws aws
Success! Enabled the aws secrets engine at: aws/

$ vault write aws/config/root access_key=[ACCESS KEY] secret_key=[SECRET_KEY]
Success! Data written to: aws/config/root

$ vault write aws/roles/my-role policy=-<<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1426528957000",
      "Effect": "Allow",
      "Action": [
        "ec2:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}
EOF
Success! Data written to: aws/roles/my-role

$ vault read aws/creds/my-role
Key                Value
---                -----
lease_id           aws/creds/my-role/9397859b-62a0-da5e-ad19-d1ee83a4810c
lease_duration     768h
lease_renewable    true
access_key         ***
secret_key         ***
security_token     <nil>

vault lease revoke aws/creds/my-role/9397859b-62a0-da5e-ad19-d1ee83a4810c
Success! Revoked lease: aws/creds/my-role/9397859b-62a0-da5e-ad19-d1ee83a4810c

$ vault path-help aws
## DESCRIPTION

The AWS backend dynamically generates AWS access keys for a set of
IAM policies. The AWS access keys have a configurable lease set and
are automatically revoked at the end of the lease.

After mounting this backend, credentials to generate IAM keys must
be configured with the "root" path and policies must be written using
the "roles/" endpoints before any access keys can be generated.

## PATHS

The following paths are supported by this backend. To view help for
any of the paths below, use the help command with any route matching
the path pattern. Note that depending on the policy of your auth token,
you may or may not be able to access certain paths.

    ^config/lease$
        Configure the default lease information for generated credentials.

    ^config/root$
        Configure the root credentials that are used to manage IAM.

    ^creds/(?P<name>\w(([\w-.]+)?\w)?)$
        Generate an access key pair for a specific role.

    ^roles/(?P<name>\w(([\w-.]+)?\w)?)$
        Read, write and reference IAM policies that access keys can be made for.

    ^roles/?$
        List the existing roles in this backend

    ^sts/(?P<name>\w(([\w-.]+)?\w)?)$
        Generate an access key pair + security token for a specific role.

$ vault path-help aws/config/root
Request:        config/root
Matching Route: ^config/root$

Configure the root credentials that are used to manage IAM.

## PARAMETERS

    access_key (string)
        Access key with permission to create new keys.

    iam_endpoint (string)
        Endpoint to custom IAM server URL

    region (string)
        Region for API calls.

    secret_key (string)
        Secret key with permission to create new keys.

    sts_endpoint (string)
        Endpoint to custom STS server URL

## DESCRIPTION

Before doing anything, the AWS backend needs credentials that are able
to manage IAM policies, users, access keys, etc. This endpoint is used
to configure those credentials. They don't necessarilly need to be root
keys as long as they have permission to manage IAM.

$ vault path-help secret
## DESCRIPTION

The kv backend reads and writes arbitrary secrets to the backend.
The secrets are encrypted/decrypted by Vault: they are never stored
unencrypted in the backend and the backend never has an opportunity to
see the unencrypted value.

TTLs can be set on a per-secret basis. These TTLs will be sent down
when that secret is read, and it is assumed that some outside process will
revoke and/or replace the secret at that path.

## PATHS

The following paths are supported by this backend. To view help for
any of the paths below, use the help command with any route matching
the path pattern. Note that depending on the policy of your auth token,
you may or may not be able to access certain paths.

    ^.*$
        Pass-through secret storage to the storage backend, allowing you to
        read/write arbitrary data into secret storage.