> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/v4/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/v4/llms-full.txt.

# Account storage 

Enterprise Edition

External account storage

Requires JumpServer Enterprise Edition. Integrate with HashiCorp Vault, Azure Key Vault, or AWS Secrets Manager to store asset credentials outside JumpServer.

[Start 14-day trial](https://www.jumpserver.com/free-trial)[View pricing](https://www.jumpserver.com/pricing)[Contact sales](https://www.jumpserver.com/contact)

Administrators can configure account storage for the system and store asset account credentials in an external system.
The following account storage types are currently supported:

- HashiCorp Vault
- Microsoft Azure Key Vault
- Amazon Web Services Secrets Manager


Note

For security reasons, account storage can currently only be configured in the service configuration file (config.txt), and the JumpServer service must be restarted after configuration.

## Enable account storage

### Using HashiCorp Vault

Please refer to and modify the following configuration:

- [VAULT_ENABLED](https://www.jumpserver.com/docs/v4/configuration.md#vault_enabled)
- [VAULT_BACKEND](https://www.jumpserver.com/docs/v4/configuration.md#vault_backend)
- [VAULT_HCP_HOST](https://www.jumpserver.com/docs/v4/configuration.md#vault_hcp_host)
- [VAULT_HCP_TOKEN](https://www.jumpserver.com/docs/v4/configuration.md#vault_hcp_token)
- [VAULT_HCP_MOUNT_POINT](https://www.jumpserver.com/docs/v4/configuration.md#vault_hcp_mount_point)

### Using Microsoft Azure Key Vault

Please refer to and modify the following configuration:

- [VAULT_ENABLED](https://www.jumpserver.com/docs/v4/configuration.md#vault_enabled)
- [VAULT_BACKEND](https://www.jumpserver.com/docs/v4/configuration.md#vault_backend)
- [VAULT_AZURE_HOST](https://www.jumpserver.com/docs/v4/configuration.md#vault_azure_host)
- [VAULT_AZURE_CLIENT_ID](https://www.jumpserver.com/docs/v4/configuration.md#vault_azure_client_id)
- [VAULT_AZURE_CLIENT_SECRET](https://www.jumpserver.com/docs/v4/configuration.md#vault_azure_client_secret)
- [VAULT_AZURE_TENANT_ID](https://www.jumpserver.com/docs/v4/configuration.md#vault_azure_tenant_id)

### Using Amazon Web Services Secrets Manager

Please refer to and modify the following configuration:

- [VAULT_ENABLED](https://www.jumpserver.com/docs/v4/configuration.md#vault_enabled)
- [VAULT_BACKEND](https://www.jumpserver.com/docs/v4/configuration.md#vault_backend)
- [VAULT_AWS_REGION_NAME](https://www.jumpserver.com/docs/v4/configuration.md#vault_aws_region_name)
- [VAULT_AWS_ACCESS_KEY_ID](https://www.jumpserver.com/docs/v4/configuration.md#vault_aws_access_key_id)
- [VAULT_AWS_ACCESS_SECRET_KEY](https://www.jumpserver.com/docs/v4/configuration.md#vault_aws_access_secret_key)

## Set the maximum number of account secret records

Administrators can set the maximum number of account secret records stored in the external vault system to avoid excessive storage usage.


1

In the right area of the top navigation bar, click .

![image](/docs/images/docs/navs/nav-settings.png)

2

In the left menu, click **<Icon name="Feature" /> Features**.

3

On the right page, click **Account storage** tab.

4

In the **Record limit** field, type the maximum number of account secret records to be stored in the external vault system.

5

Click **Submit**.

## Synchronize account secrets to external vault

After enabling account storage, administrators need to manually sync existing account secrets stored in JumpServer's local database to the external vault system.


1

In the right area of the top navigation bar, click .

![image](/docs/images/docs/navs/nav-settings.png)

2

In the left menu, click **<Icon name="Feature" /> Features**.

3

On the right page, click **Account storage** tab.

4

Click **Sync**.


Note

Account credentials can only be synchronized from the local database to the external account storage, reverse synchronization is not supported.