func (v EnvVault) read(path string) (*api.Secret, error) {
	r := v.client.NewRequest("GET", "/v1/"+path)
	resp, err := v.client.RawRequest(r)
	if err != nil {
		return nil, err
	}
	if resp == nil {
		return nil, err
	}
	defer resp.Body.Close()
	if resp.StatusCode != 200 {
		return nil, nil
	}
	return api.ParseSecret(resp.Body)
}
read secret using http Vault api
package vault
import (
	"bytes"
	"encoding/json"
	"fmt"
	"io/ioutil"
	"net/url"
	"os"
	"strings"
	"time"
	"github.com/hashicorp/vault/api"
	"github.com/pkg/errors"
	log "github.com/sirupsen/logrus"
)
const (
	VaultURLScheme  = "vault"
	VaultDefaultKey = "value"
	DefaultAWSRoleTTL = 3600  
)
type Vault interface {
	DecryptAllEnv([]string) ([]string, error)
	GetAWSCredsLease(role string) (*VaultAWSCredsLease, error)
	RevokeAWSCredsLease(leaseID, role string) error
	RenewAWSCredsLease(awsCredsLease *VaultAWSCredsLease, ttl int) (*VaultAWSCredsLease, error)
	MaybeRevokeToken() error
}
type EnvVault struct {
	client  VaultAPI
	config  *EnvVaultConfig
	handler TokenAuthHandler
	token string
}
type EnvVaultConfig struct {
	AWSRole       string        `envconfig:"AWS_ROLE"`
	AWSRoleTTL    time.Duration `envconfig:"AWS_ROLE_TTL"`
	AWSRoleMaxTTL time.Duration `envconfig:"AWS_ROLE_MAX_TTL"`
}
type VaultAPI interface {
	Address() string
	NewRequest(method, path string) *api.Request
	RawRequest(r *api.Request) (*api.Response, error)
}
func NewDefaultVault(config *EnvVaultConfig) EnvVault {
	conf := api.DefaultConfig()
	err := conf.ReadEnvironment()
	if err != nil {
		log.Warnf("Unable to load Environment vars: %s", err)
	}
	log.Infof("Vault address '%s' ", conf.Address)
	vaultClient, _ := api.NewClient(conf)
	envVault := EnvVault{
		client:  vaultClient,
		config:  config,
		handler: &vaultTokenAuthHandler{client: vaultClient},
	}
	log.Debugf("Vault Config: %#v", config)
	if config.AWSRole != "" {
		err := getAWSRoleVaultToken(&envVault)
		if err != nil {
			log.Errorf("Failed to get Vault parent Token to enable AWS Role: %s", err)
		}
	} else if os.Getenv("VAULT_TOKEN") == "" {
		err := GetToken(envVault.handler)
		if err != nil {
			log.Errorf("Failure authenticating with Vault: %s", err)
		}
	}
	return envVault
}
func getAWSRoleVaultToken(envVault *EnvVault) error {
	var (
		ttl int = DefaultAWSRoleTTL
		err error
	)
	log.Info("Attempting to get a service-specific parent token with TTL to match requested AWS Role")
	if envVault.config.AWSRoleTTL != time.Duration(0) {
		if (envVault.config.AWSRoleTTL > envVault.config.AWSRoleMaxTTL) && (envVault.config.AWSRoleMaxTTL != 0) {
			return fmt.Errorf(
				"AWSRoleTTL cannot be longer than AWSRoleMaxTTL: %s vs %s",
				envVault.config.AWSRoleTTL, envVault.config.AWSRoleMaxTTL,
			)
		}
		ttl = int(envVault.config.AWSRoleTTL / time.Second)
	}
	token, err := GetTokenWithLogin(envVault.handler, ttl)
	if err != nil {
		return err
	}
	envVault.handler.SetToken(token)
	envVault.token = token
	log.Info("Service-specific token stored")
	return nil
}
func (v EnvVault) DecryptAllEnv(envs []string) ([]string, error) {
	var decryptedEnv []string
	for _, env := range envs {
		keyValue := strings.SplitN(env, "=", 2)
		envName := keyValue[0]
		envValue := keyValue[1]
		if isVaultPath(envValue) {
			log.Debugf("Fetching secret value for path: '%s' [VAULT_ADDR: %s]", envValue, v.client.Address())
			decrypted, err := v.ReadSecretValue(envValue)
			if err != nil {
				return nil, err
			}
			log.Infof("Decrypted '%s' [VAULT_ADDR: %s, path: %s ]", envName, v.client.Address(), envValue)
			envValue = decrypted
		}
		decryptedEnv = append(decryptedEnv, fmt.Sprintf("%s=%s", envName, envValue))
	}
	return decryptedEnv, nil
}
func (v EnvVault) ReadSecretValue(vaultURL string) (string, error) {
	parsed, err := url.Parse(vaultURL)
	if err != nil {
		return "", errors.Errorf("Unable to parse Vault URL: '%s'", vaultURL)
	}
	if parsed.Scheme != VaultURLScheme {
		return "", errors.Errorf("Invalid Vault URL '%s', expecting scheme '%s://'", vaultURL, VaultURLScheme)
	}
	path := parsed.Host + parsed.Path
	secret, err := v.read(path)
	if err != nil {
		return "", errors.Errorf("Unable to fetch '%s' [VAULT_ADDR:%s] error: %s", path, v.client.Address(), err)
	}
	if secret == nil {
		return "", errors.Errorf("Path '%s' not found [VAULT_ADDR:%s]", path, v.client.Address())
	}
	q := parsed.Query()
	key := q["key"]
	if key == nil {
		key = []string{VaultDefaultKey}
	}
	value, ok := secret.Data[key[0]].(string)
	if !ok {
		return "", errors.Errorf("Value for path '%s' not found [VAULT_ADDR:%s]", path, v.client.Address())
	}
	return value, nil
}
func isVaultPath(value string) bool {
	hasPrefix := strings.HasPrefix(value, VaultURLScheme+"://")
	return hasPrefix
}