EV-Q28-01-vault-status

Terminal evidence for PCI DSS QSA audit. Timestamps in UTC.

=== Evidence Q28-01 — Vault cluster status + policies + audit ===
Timestamp: 2026-08-01T16:43:30Z
Referencia: PCI DSS v4.0 Req 3.5, 3.6, 3.7

$ vault status
Key                     Value
---                     -----
Seal Type               shamir
Initialized             true
Sealed                  false
Total Shares            5
Threshold               3
Version                 1.15.6
Build Date              2024-02-28T17:07:34Z
Storage Type            raft
Cluster Name            fintrix-prod-vault-cluster
Cluster ID              f5761eb9-b88e-21e6-8cd7-228dbe81d9ed
HA Enabled              true
HA Cluster              https://10.100.0.19:8201
HA Mode                 standby

$ vault operator raft list-peers
Node        Address             State       Voter
----        -------             -----       -----
vault-01    10.100.0.13:8201    follower    true
vault-02    10.100.0.19:8201    leader      true
vault-03    10.100.0.20:8201    follower    true

$ vault policy list
card-vault-transit-policy
controlcase-audit
crypto-admin-policy
default
fraud-investigator-policy
tokenization-transit-policy
root

$ vault audit list
Path       Type      Description
----       ----      -----------
file/      file      n/a
syslog/    syslog    n/a

$ vault read transit/keys/kek-card-vault
Key                       Value
---                       -----
allow_plaintext_backup    false
auto_rotate_period        8760h
deletion_allowed          false
derived                   false
exportable                false
imported_key              false
keys                      map[1:1785449718 2:1785470381]
latest_version            2
min_available_version     0
min_decryption_version    1
min_encryption_version    0
name                      kek-card-vault
supports_decryption       true
supports_derivation       true
supports_encryption       true
supports_signing          false
type                      aes256-gcm96

---

Auto-generated evidence — do not edit. Regenerable via commands documented in the parent EVD document.