🔐 Verifying DataStax AstraDB + HashiCorp Vault

Local Compliance, Zero Leaks, and a Script That Actually Cares

© Image generated with DALL·E 3 via ChatGPT by OpenAI for illustrative and editorial purposes only.

I’ve learned something the hard way over the years: most credential leaks don’t happen in production. They happen right on our laptops.

A stray .env copy, a forgotten token in a test script, or — my personal favorite — a GitHub push protection screaming at you like a fire alarm you pretended wasn’t real.

And nothing reminds you of this faster than an AstraCS token or a Vault token accidentally slipping into a commit.

This article is about stopping that.

Not with theory.
Not with “make sure your secrets are safe” fluff.

But with a real verification script that checks your local state, your Vault KV path, and your Astra secure connect bundle — and tells you in blunt, color-coded honesty whether you’re safe or whether you should stop everything immediately.

This is local compliance for people who’d rather ship features than debug credential leaks.

🌡️ The Pain: A Real GH013 Slap in the Face

Here’s the moment that motivated this article.

I pushed a harmless update.

GitHub said nope.

GH013: Push cannot contain secrets
— HashiCorp Vault Root Service Token
— Datastax AstraCS Tokens

The culprit?
A file called .env copy I didn’t even know I still had.

I cleaned it up manually — but that’s when the penny dropped.

It wasn’t the error that bothered me — it was the realization that even with the best tooling, local hygiene still depends on humans. And humans miss things. Local workflows need better tooling.. And a bit of a compliance check..

So I built it.

🧩 The Goal: A Script That Tells the Truth

I wanted one tool that checks the entire Astra + Vault local setup and answers two questions:

1. Am I leaking secrets right now?

(.env, config drift, missing Vault fields, tokens in the wrong place)

2. Can I actually reach Astra cleanly?

(using the secure connect bundle, not localhost carnival rides)

But more importantly:

3. Does this setup meet my standard?

Not “it works.”
Not “it probably works.”
But:

This is green.
This is correct.
This is how we teach it in workshops.

This isn’t a production tool.
It’s a local guardrail.
A pre-flight check that tells you whether your environment is clean enough to trust.

🛡️ verify_astra_vault.sh

A local compliance script for AstraDB + Vault
(full source: https://github.com/raymonepping/music_library)

Get Raymon Epping’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

This one script checks:

✔️ .env secret hygiene

• No Astra tokens
• No Astra IDs, regions, keyspaces, or endpoints

✔️ Vault KV structure

• ASTRA_DB_ID
• ASTRA_DB_REGION
• ASTRA_DB_KEYSPACE
• ASTRA_DB_TOKEN
• ASTRA_DB_ENDPOINT
• ASTRA_SCB_PATH

All under:

kv/datastax

✔️ Effective config

Vault is treated as the source of truth. Any sensitive .env fields are ignored and flagged until your local state is clean.

✔️ Automatic cqlsh-astra installation

• Automatically downloads the correct tarball
• Automatically installs Python 3.11.9 via pyenv
• Installs six
• Creates a wrapper so cqlsh always runs cleanly

✔️ CQL bundle connectivity test

This is the actual “can I reach Astra?” test.

✔️ Optional REST test

Enabled only with --rest or --debug.

🔍 Before & After

This is the part that convinced me the script works exactly as intended.

❌ Before (bad state with .env secrets)

📦 Evaluating Astra secret hygiene (.env)...
🔴 ASTRA_DB_TOKEN     Astra DB token present in .env
🟠 ASTRA_DB_* config  Non-secret config present in .env
...
🚨 Global verdict: 🔴 FIX BEFORE CONTINUING

This is the moment you stop.
Not “later.”
Not “just push once more.”

This is exactly the kind of silent drift that causes leaks — and exactly what this script is meant to expose.

✅ After (fully Vault-driven, clean state)

📦 Evaluating Astra secret hygiene (.env)...
🟢 ASTRA_DB_* in .env     No Astra fields in .env
...
💾 cqlsh connectivity      cqlsh connected successfully via secure connect bundle.
...
✅ Global verdict: 🟢 SAFE FOR WORKSHOPS

No secrets.
No drift.
No guessing.
Just green.

This is the standard.

🛠️ How to Use It

You don’t need the whole project.
You only need one file:

verify_astra_vault.sh

Grab it directly:

curl -O https://raw.githubusercontent.com/raymonepping/music_library/main/verify_astra_vault.sh
chmod +x verify_astra_vault.sh

Run it:

./verify_astra_vault.sh

Optional flags:

./verify_astra_vault.sh --rest
./verify_astra_vault.sh --debug
./verify_astra_vault.sh --strict
./verify_astra_vault.sh --require-cqlsh

The REST test is intentionally opt-in, because Astra’s REST edge sometimes throws 5xx even when cqlsh (and the DB) is completely healthy.

🎯 Why This Matters

This little script does something our industry keeps forgetting:

Local verification matters just as much as production verification.

Leaked tokens don’t start in CI.
They start in:

• Old .env files
• Half-migrated tokens
• Mistyped variables
• Misaligned configs
• “I’ll fix it later” moments

This script removes those edge cases.
It gives you truth upfront, before GitHub needs to rescue you.

It also gives anyone attending your workshop the confidence that:

• their secrets are in Vault
• their bundle works
• cqlsh connects
• no token is leaking anywhere
• and their local environment is clean and compliant

That’s what we should teach.

🏁 Closing

This might look like a small utility script.
It’s not.

It’s a guardrail.
It becomes a habit.
It’s a boundary between “I hope this is safe” and “I know this is safe.”

And honestly — nothing feels better than seeing:

🟢 SAFE FOR WORKSHOPS

Especially when you know how easy it is to accidentally leak an Astra token.

🧠 Born from How I Use AI as My DevOps Copilot
🤖 Powered by Sally — my AI DevOps copilot
🚀 Because automation should automate itself

📘 Journey recap : Turning From 50 Shades of Red into Blue