Vault: Error initializing Vault with DynamoDB

[MaximF]

Hello everyone,

We are going to launch Vaultin AWS with DynamoDB storage backend and so far couldn't initialize Vault with it.

Vault starts properly with this simplified config:

/etc/vault.conf

storage "dynamodb" {
  region     = "us-east-1"
  table      = "vault-data-test-1"
  access_key = "<ACCESS_KEY>"
  secret_key = "<SECRET_KEY>"
  advertise_addr = "http://127.0.0.1:8200"
}
listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = 1
}

And upon initialization attempt

vault init -address=http://127.0.0.1:8200

getting this response:

Error initializing Vault: Error making API request.
URL: PUT http://127.0.0.1:8200/v1/sys/init
Code: 400. Errors:
* failed to check for initialization: ValidationException: The provided key element does not match the schema
        status code: 400, request id: 4J1N5NM59NUQ5CDNJONS7D01E3VV4KQNSO5AEMVJF66Q9ASUAAJG

Running Vault v0.8.0 on Ubuntu 16.04.3 LTS.
DynamoDB was created with default settings, named as vault-data-test-1 with PrimaryKey called PrimaryKey.

Expected Behavior:
Vault should be initialized and began using DynamoDB

It feels like it might require some special key to exist, but neither documentation nor original PR mention that.

[MaximF]

Kudos to @acelaya for his explanation!
For anyone who might experience the same issue, here is a solution: Vault would automatically create DynamoDB table upon initiation, there is no need to create it in advance manually.

[mainiak]

I run into same issue before. Maybe highlighting this would be nice in documentation.

Table: Specifies the name of the DynamoDB table in which to store Vault data. If the specified table does not yet exist, it will be created during initialization.

[mwascak]

I don't see any explanation available. It doesn't seem like Vault has the embedded code or permssions to deploy its own dynamodb table of which a partition key is required.

[rcmorano]

IMHO, at least for the AWS use case, Vault shouldn't assume it will run under a role that is allowed to perform "dynamodb:CreateTable".

In my scenario, Vault it's only allowed to perform operations on its designated table; but not any other administrative operation in DynamoDB itself.