misc: migrated to use multiple app connections

backend/src/@types/knex.d.ts

@@ -83,9 +83,6 @@ import {
   TExternalKms,
   TExternalKmsInsert,
   TExternalKmsUpdate,
-  TExternalMigrationConfigs,
-  TExternalMigrationConfigsInsert,
-  TExternalMigrationConfigsUpdate,
   TFolderCheckpointResources,
   TFolderCheckpointResourcesInsert,
   TFolderCheckpointResourcesUpdate,
@@ -521,6 +518,9 @@ import {
   TUsers,
   TUsersInsert,
   TUsersUpdate,
+  TVaultExternalMigrationConfigs,
+  TVaultExternalMigrationConfigsInsert,
+  TVaultExternalMigrationConfigsUpdate,
   TWebhooks,
   TWebhooksInsert,
   TWebhooksUpdate,
@@ -1348,10 +1348,10 @@ declare module "knex/types/tables" {
       TAdditionalPrivilegesInsert,
       TAdditionalPrivilegesUpdate
     >;
-    [TableName.ExternalMigrationConfig]: KnexOriginal.CompositeTableType<
-      TExternalMigrationConfigs,
-      TExternalMigrationConfigsInsert,
-      TExternalMigrationConfigsUpdate
+    [TableName.VaultExternalMigrationConfig]: KnexOriginal.CompositeTableType<
+      TVaultExternalMigrationConfigs,
+      TVaultExternalMigrationConfigsInsert,
+      TVaultExternalMigrationConfigsUpdate
     >;
   }
 }

backend/src/db/migrations/20251013104547_add-in-platform-external-migration.ts

@@ -4,25 +4,26 @@ import { TableName } from "../schemas";
 import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
 
 export async function up(knex: Knex): Promise<void> {
-  if (!(await knex.schema.hasTable(TableName.ExternalMigrationConfig))) {
-    await knex.schema.createTable(TableName.ExternalMigrationConfig, (t) => {
+  if (!(await knex.schema.hasTable(TableName.VaultExternalMigrationConfig))) {
+    await knex.schema.createTable(TableName.VaultExternalMigrationConfig, (t) => {
       t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
       t.uuid("orgId").notNullable();
       t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
-      t.string("platform").notNullable();
+
+      t.string("namespace").notNullable();
 
       t.uuid("connectionId");
       t.foreign("connectionId").references("id").inTable(TableName.AppConnection);
 
       t.timestamps(true, true, true);
-      t.unique(["orgId", "platform"]);
+      t.unique(["orgId", "namespace"]);
     });
 
-    await createOnUpdateTrigger(knex, TableName.ExternalMigrationConfig);
+    await createOnUpdateTrigger(knex, TableName.VaultExternalMigrationConfig);
   }
 }
 
 export async function down(knex: Knex): Promise<void> {
-  await knex.schema.dropTableIfExists(TableName.ExternalMigrationConfig);
-  await dropOnUpdateTrigger(knex, TableName.ExternalMigrationConfig);
+  await knex.schema.dropTableIfExists(TableName.VaultExternalMigrationConfig);
+  await dropOnUpdateTrigger(knex, TableName.VaultExternalMigrationConfig);
 }

backend/src/db/schemas/external-migration-configs.ts

@@ -1,23 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const ExternalMigrationConfigsSchema = z.object({
-  id: z.string().uuid(),
-  orgId: z.string().uuid(),
-  platform: z.string(),
-  connectionId: z.string().uuid().nullable().optional(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TExternalMigrationConfigs = z.infer<typeof ExternalMigrationConfigsSchema>;
-export type TExternalMigrationConfigsInsert = Omit<z.input<typeof ExternalMigrationConfigsSchema>, TImmutableDBKeys>;
-export type TExternalMigrationConfigsUpdate = Partial<
-  Omit<z.input<typeof ExternalMigrationConfigsSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/index.ts

@@ -25,7 +25,6 @@ export * from "./dynamic-secrets";
 export * from "./external-certificate-authorities";
 export * from "./external-group-org-role-mappings";
 export * from "./external-kms";
-export * from "./external-migration-configs";
 export * from "./folder-checkpoint-resources";
 export * from "./folder-checkpoints";
 export * from "./folder-commit-changes";
@@ -177,5 +176,6 @@ export * from "./user-aliases";
 export * from "./user-encryption-keys";
 export * from "./user-group-membership";
 export * from "./users";
+export * from "./vault-external-migration-configs";
 export * from "./webhooks";
 export * from "./workflow-integrations";

backend/src/db/schemas/models.ts

@@ -205,7 +205,7 @@ export enum TableName {
   PamAccount = "pam_accounts",
   PamSession = "pam_sessions",
 
-  ExternalMigrationConfig = "external_migration_configs"
+  VaultExternalMigrationConfig = "vault_external_migration_configs"
 }
 
 export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt" | "commitId";

backend/src/db/schemas/vault-external-migration-configs.ts

@@ -0,0 +1,26 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const VaultExternalMigrationConfigsSchema = z.object({
+  id: z.string().uuid(),
+  orgId: z.string().uuid(),
+  namespace: z.string(),
+  connectionId: z.string().uuid().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TVaultExternalMigrationConfigs = z.infer<typeof VaultExternalMigrationConfigsSchema>;
+export type TVaultExternalMigrationConfigsInsert = Omit<
+  z.input<typeof VaultExternalMigrationConfigsSchema>,
+  TImmutableDBKeys
+>;
+export type TVaultExternalMigrationConfigsUpdate = Partial<
+  Omit<z.input<typeof VaultExternalMigrationConfigsSchema>, TImmutableDBKeys>
+>;

backend/src/server/routes/index.ts

@@ -174,9 +174,9 @@ import { cmekServiceFactory } from "@app/services/cmek/cmek-service";
 import { convertorServiceFactory } from "@app/services/convertor/convertor-service";
 import { externalGroupOrgRoleMappingDALFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-dal";
 import { externalGroupOrgRoleMappingServiceFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-service";
-import { externalMigrationConfigDALFactory } from "@app/services/external-migration/external-migration-config-dal";
 import { externalMigrationQueueFactory } from "@app/services/external-migration/external-migration-queue";
 import { externalMigrationServiceFactory } from "@app/services/external-migration/external-migration-service";
+import { vaultExternalMigrationConfigDALFactory } from "@app/services/external-migration/vault-external-migration-config-dal";
 import { folderCheckpointDALFactory } from "@app/services/folder-checkpoint/folder-checkpoint-dal";
 import { folderCheckpointResourcesDALFactory } from "@app/services/folder-checkpoint-resources/folder-checkpoint-resources-dal";
 import { folderCommitDALFactory } from "@app/services/folder-commit/folder-commit-dal";
@@ -534,7 +534,7 @@ export const registerRoutes = async (
   const membershipRoleDAL = membershipRoleDALFactory(db);
   const roleDAL = roleDALFactory(db);
 
-  const externalMigrationConfigDAL = externalMigrationConfigDALFactory(db);
+  const vaultExternalMigrationConfigDAL = vaultExternalMigrationConfigDALFactory(db);
 
   const eventBusService = eventBusFactory(server.redis);
   const sseService = sseServiceFactory(eventBusService, server.redis);
@@ -2199,7 +2199,7 @@ export const registerRoutes = async (
     gatewayService,
     kmsService,
     appConnectionService,
-    externalMigrationConfigDAL,
+    vaultExternalMigrationConfigDAL,
     secretService,
     auditLogService
   });

backend/src/server/routes/v3/external-migration-router.ts

@@ -117,33 +117,64 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
 
   server.route({
     method: "GET",
-    url: "/config",
+    url: "/vault/configs",
     config: {
       rateLimit: readLimit
     },
     schema: {
-      querystring: z.object({
-        platform: z.nativeEnum(ExternalMigrationProviders)
-      }),
       response: {
         200: z.object({
-          config: z
+          configs: z
             .object({
               id: z.string(),
               orgId: z.string(),
-              platform: z.string(),
+              namespace: z.string(),
               connectionId: z.string().nullable().optional(),
               createdAt: z.date(),
               updatedAt: z.date()
             })
-            .nullable()
+            .array()
         })
       }
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const config = await server.services.migration.getExternalMigrationConfig({
-        platform: req.query.platform,
+      const configs = await server.services.migration.getVaultExternalMigrationConfigs({
+        actor: req.permission
+      });
+
+      return { configs };
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/vault/configs",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      body: z.object({
+        connectionId: z.string(),
+        namespace: z.string()
+      }),
+      response: {
+        200: z.object({
+          config: z.object({
+            id: z.string(),
+            orgId: z.string(),
+            namespace: z.string(),
+            connectionId: z.string().nullable().optional(),
+            createdAt: z.date(),
+            updatedAt: z.date()
+          })
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const config = await server.services.migration.createVaultExternalMigration({
+        ...req.body,
         actor: req.permission
       });
 
@@ -153,21 +184,24 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
 
   server.route({
     method: "PUT",
-    url: "/config",
+    url: "/vault/configs/:id",
     config: {
       rateLimit: writeLimit
     },
     schema: {
+      params: z.object({
+        id: z.string()
+      }),
       body: z.object({
-        connectionId: z.string().nullable(),
-        platform: z.nativeEnum(ExternalMigrationProviders)
+        connectionId: z.string(),
+        namespace: z.string()
       }),
       response: {
         200: z.object({
           config: z.object({
             id: z.string(),
             orgId: z.string(),
-            platform: z.string(),
+            namespace: z.string(),
             connectionId: z.string().nullable().optional(),
             createdAt: z.date(),
             updatedAt: z.date()
@@ -175,12 +209,48 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
         })
       }
     },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const config = await server.services.migration.configureExternalMigration({
+      const config = await server.services.migration.updateVaultExternalMigration({
+        id: req.params.id,
         ...req.body,
         actor: req.permission
       });
+
+      return { config };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/vault/configs/:id",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      params: z.object({
+        id: z.string()
+      }),
+      response: {
+        200: z.object({
+          config: z.object({
+            id: z.string(),
+            orgId: z.string(),
+            namespace: z.string(),
+            connectionId: z.string().nullable().optional(),
+            createdAt: z.date(),
+            updatedAt: z.date()
+          })
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const config = await server.services.migration.deleteVaultExternalMigration({
+        id: req.params.id,
+        actor: req.permission
+      });
+
       return { config };
     }
   });
@@ -243,7 +313,7 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
     },
     schema: {
       querystring: z.object({
-        namespace: z.string().optional()
+        namespace: z.string()
       }),
       response: {
         200: z.object({

backend/src/services/external-migration/external-migration-service.ts

@@ -20,7 +20,6 @@ import {
   getHCVaultSecretsForPath,
   HCVaultAuthType,
   listHCVaultMounts,
-  listHCVaultNamespaces,
   listHCVaultPolicies,
   listHCVaultSecretPaths,
   THCVaultConnection
@@ -29,7 +28,6 @@ import { TKmsServiceFactory } from "../kms/kms-service";
 import { TSecretServiceFactory } from "../secret/secret-service";
 import { SecretProtectionType } from "../secret/secret-types";
 import { TUserDALFactory } from "../user/user-dal";
-import { TExternalMigrationConfigDALFactory } from "./external-migration-config-dal";
 import {
   decryptEnvKeyDataFn,
   importVaultDataFn,
@@ -40,12 +38,15 @@ import { TExternalMigrationQueueFactory } from "./external-migration-queue";
 import {
   ExternalMigrationProviders,
   ExternalPlatforms,
-  TConfigureExternalMigrationDTO,
+  TCreateVaultExternalMigrationDTO,
+  TDeleteVaultExternalMigrationDTO,
   THasCustomVaultMigrationDTO,
   TImportEnvKeyDataDTO,
   TImportVaultDataDTO,
+  TUpdateVaultExternalMigrationDTO,
   VaultImportStatus
 } from "./external-migration-types";
+import { TVaultExternalMigrationConfigDALFactory } from "./vault-external-migration-config-dal";
 
 type TExternalMigrationServiceFactoryDep = {
   permissionService: TPermissionServiceFactory;
@@ -53,7 +54,10 @@ type TExternalMigrationServiceFactoryDep = {
   auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
   externalMigrationQueue: TExternalMigrationQueueFactory;
   appConnectionService: Pick<TAppConnectionServiceFactory, "connectAppConnectionById">;
-  externalMigrationConfigDAL: Pick<TExternalMigrationConfigDALFactory, "create" | "upsert" | "findOne" | "transaction">;
+  vaultExternalMigrationConfigDAL: Pick<
+    TVaultExternalMigrationConfigDALFactory,
+    "create" | "findOne" | "transaction" | "find" | "updateById" | "deleteById" | "findById"
+  >;
   userDAL: Pick<TUserDALFactory, "findById">;
   gatewayService: Pick<TGatewayServiceFactory, "fnGetGatewayClientTlsByGatewayId">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
@@ -69,7 +73,7 @@ export const externalMigrationServiceFactory = ({
   secretService,
   auditLogService,
   appConnectionService,
-  externalMigrationConfigDAL,
+  vaultExternalMigrationConfigDAL,
   kmsService
 }: TExternalMigrationServiceFactoryDep) => {
   const importEnvKeyData = async ({
@@ -208,7 +212,35 @@ export const externalMigrationServiceFactory = ({
     return actorOrgId in vaultMigrationTransformMappings;
   };
 
-  const configureExternalMigration = async ({ platform, connectionId, actor }: TConfigureExternalMigrationDTO) => {
+  const validateVaultExternalMigrationConnection = async ({
+    connection,
+    namespace
+  }: {
+    connection: THCVaultConnection;
+    namespace: string;
+  }) => {
+    // Allow root namespace access when no namespace is configured on the connection
+    const isRootAccess = namespace === "root" || namespace === "/";
+    const hasNoNamespace = connection.credentials.namespace === undefined;
+
+    if (hasNoNamespace && isRootAccess) {
+      // Skip validation for root access with no configured namespace
+    } else if (connection.credentials.namespace !== namespace) {
+      throw new BadRequestError({ message: "Namespace value does not match the namespace of the connection" });
+    }
+
+    try {
+      await listHCVaultPolicies(namespace, connection, gatewayService);
+      await listHCVaultSecretPaths(namespace, connection, gatewayService);
+      await listHCVaultMounts(connection, gatewayService);
+    } catch (error) {
+      throw new BadRequestError({
+        message: `Failed to establish namespace confiugration. ${error instanceof Error ? error.message : "Unknown error"}`
+      });
+    }
+  };
+
+  const createVaultExternalMigration = async ({ namespace, connectionId, actor }: TCreateVaultExternalMigrationDTO) => {
     const { hasRole } = await permissionService.getOrgPermission(
       actor.type,
       actor.id,
@@ -218,19 +250,22 @@ export const externalMigrationServiceFactory = ({
     );
 
     if (!hasRole(OrgMembershipRole.Admin)) {
-      throw new ForbiddenRequestError({ message: "Only admins can configure external migration" });
+      throw new ForbiddenRequestError({ message: "Only admins can configure vault external migration" });
     }
 
-    if (connectionId) {
-      if (platform === ExternalMigrationProviders.Vault) {
-        await appConnectionService.connectAppConnectionById(AppConnection.HCVault, connectionId, actor);
-      } else {
-        throw new BadRequestError({ message: "Invalid platform" });
-      }
-    }
+    const connection = await appConnectionService.connectAppConnectionById<THCVaultConnection>(
+      AppConnection.HCVault,
+      connectionId,
+      actor
+    );
 
-    const config = await externalMigrationConfigDAL.upsert({
-      platform,
+    await validateVaultExternalMigrationConnection({
+      connection,
+      namespace
+    });
+
+    const config = await vaultExternalMigrationConfigDAL.create({
+      namespace,
       connectionId,
       orgId: actor.orgId
     });
@@ -238,7 +273,12 @@ export const externalMigrationServiceFactory = ({
     return config;
   };
 
-  const getExternalMigrationConfig = async ({ platform, actor }: { platform: string; actor: OrgServiceActor }) => {
+  const updateVaultExternalMigration = async ({
+    id,
+    namespace,
+    connectionId,
+    actor
+  }: TUpdateVaultExternalMigrationDTO) => {
     const { hasRole } = await permissionService.getOrgPermission(
       actor.type,
       actor.id,
@@ -248,19 +288,48 @@ export const externalMigrationServiceFactory = ({
     );
 
     if (!hasRole(OrgMembershipRole.Admin)) {
-      throw new ForbiddenRequestError({ message: "Only admins can view external migration config" });
+      throw new ForbiddenRequestError({ message: "Only admins can update vault external migration" });
     }
 
-    const config = await externalMigrationConfigDAL.findOne({
-      orgId: actor.orgId,
-      platform
+    if (connectionId) {
+      const connection = await appConnectionService.connectAppConnectionById<THCVaultConnection>(
+        AppConnection.HCVault,
+        connectionId,
+        actor
+      );
+
+      await validateVaultExternalMigrationConnection({
+        connection,
+        namespace
+      });
+    }
+
+    const config = await vaultExternalMigrationConfigDAL.updateById(id, {
+      namespace,
+      connectionId
     });
 
-    if (!config) {
-      throw new NotFoundError({ message: "External migration config not found" });
+    return config;
+  };
+
+  const getVaultExternalMigrationConfigs = async ({ actor }: { actor: OrgServiceActor }) => {
+    const { hasRole } = await permissionService.getOrgPermission(
+      actor.type,
+      actor.id,
+      actor.orgId,
+      actor.authMethod,
+      actor.orgId
+    );
+
+    if (!hasRole(OrgMembershipRole.Admin)) {
+      throw new ForbiddenRequestError({ message: "Only admins can view vault external migration configs" });
     }
 
-    return config;
+    const configs = await vaultExternalMigrationConfigDAL.find({
+      orgId: actor.orgId
+    });
+
+    return configs;
   };
 
   const getVaultNamespaces = async ({ actor }: { actor: OrgServiceActor }) => {
@@ -276,32 +345,18 @@ export const externalMigrationServiceFactory = ({
       throw new ForbiddenRequestError({ message: "Only admins can view vault namespaces" });
     }
 
-    const vaultConfig = await externalMigrationConfigDAL.findOne({
-      orgId: actor.orgId,
-      platform: ExternalMigrationProviders.Vault
+    // Get all configured namespaces for this org
+    const vaultConfigs = await vaultExternalMigrationConfigDAL.find({
+      orgId: actor.orgId
     });
 
-    if (!vaultConfig) {
-      throw new BadRequestError({ message: "Vault migration config not found" });
-    }
+    // Return the configured namespaces as an array of objects with id and name
+    // where both id and name are the namespace path
+    const namespaces = vaultConfigs.map((config) => ({
+      id: config.namespace,
+      name: config.namespace
+    }));
 
-    if (!vaultConfig.connection) {
-      throw new BadRequestError({ message: "Vault migration connection is not configured" });
-    }
-
-    const credentials = await decryptAppConnectionCredentials({
-      orgId: vaultConfig.orgId,
-      encryptedCredentials: vaultConfig.connection.encryptedCredentials,
-      kmsService,
-      projectId: null
-    });
-
-    const connection = {
-      ...vaultConfig.connection,
-      credentials
-    } as THCVaultConnection;
-
-    const namespaces = await listHCVaultNamespaces(connection, gatewayService);
     return namespaces;
   };
 
@@ -318,17 +373,17 @@ export const externalMigrationServiceFactory = ({
       throw new ForbiddenRequestError({ message: "Only admins can view vault policies" });
     }
 
-    const vaultConfig = await externalMigrationConfigDAL.findOne({
+    const vaultConfig = await vaultExternalMigrationConfigDAL.findOne({
       orgId: actor.orgId,
-      platform: ExternalMigrationProviders.Vault
+      namespace
     });
 
     if (!vaultConfig) {
-      throw new NotFoundError({ message: "Vault migration config not found" });
+      throw new NotFoundError({ message: "Vault migration config not found for this namespace" });
     }
 
     if (!vaultConfig.connection) {
-      throw new BadRequestError({ message: "Vault migration connection is not configured" });
+      throw new BadRequestError({ message: "Vault migration connection is not configured for this namespace" });
     }
 
     const credentials = await decryptAppConnectionCredentials({
@@ -347,7 +402,7 @@ export const externalMigrationServiceFactory = ({
     return policies;
   };
 
-  const getVaultMounts = async ({ actor, namespace }: { actor: OrgServiceActor; namespace?: string }) => {
+  const getVaultMounts = async ({ actor, namespace }: { actor: OrgServiceActor; namespace: string }) => {
     const { hasRole } = await permissionService.getOrgPermission(
       actor.type,
       actor.id,
@@ -360,17 +415,17 @@ export const externalMigrationServiceFactory = ({
       throw new ForbiddenRequestError({ message: "Only admins can view vault mounts" });
     }
 
-    const vaultConfig = await externalMigrationConfigDAL.findOne({
+    const vaultConfig = await vaultExternalMigrationConfigDAL.findOne({
       orgId: actor.orgId,
-      platform: ExternalMigrationProviders.Vault
+      namespace
     });
 
     if (!vaultConfig) {
-      throw new NotFoundError({ message: "Vault migration config not found" });
+      throw new NotFoundError({ message: "Vault migration config not found for this namespace" });
     }
 
     if (!vaultConfig.connection) {
-      throw new BadRequestError({ message: "Vault migration connection is not configured" });
+      throw new BadRequestError({ message: "Vault migration connection is not configured for this namespace" });
     }
 
     const credentials = await decryptAppConnectionCredentials({
@@ -402,17 +457,17 @@ export const externalMigrationServiceFactory = ({
       throw new ForbiddenRequestError({ message: "Only admins can view vault secret paths" });
     }
 
-    const vaultConfig = await externalMigrationConfigDAL.findOne({
+    const vaultConfig = await vaultExternalMigrationConfigDAL.findOne({
       orgId: actor.orgId,
-      platform: ExternalMigrationProviders.Vault
+      namespace
     });
 
     if (!vaultConfig) {
-      throw new NotFoundError({ message: "Vault migration config not found" });
+      throw new NotFoundError({ message: "Vault migration config not found for this namespace" });
     }
 
     if (!vaultConfig.connection) {
-      throw new BadRequestError({ message: "Vault migration connection is not configured" });
+      throw new BadRequestError({ message: "Vault migration connection is not configured for this namespace" });
     }
 
     const credentials = await decryptAppConnectionCredentials({
@@ -461,17 +516,17 @@ export const externalMigrationServiceFactory = ({
       throw new ForbiddenRequestError({ message: "Only admins can import vault secrets" });
     }
 
-    const vaultConfig = await externalMigrationConfigDAL.findOne({
+    const vaultConfig = await vaultExternalMigrationConfigDAL.findOne({
       orgId: actor.orgId,
-      platform: ExternalMigrationProviders.Vault
+      namespace: vaultNamespace
     });
 
     if (!vaultConfig) {
-      throw new NotFoundError({ message: "Vault migration config not found" });
+      throw new NotFoundError({ message: "Vault migration config not found for this namespace" });
     }
 
     if (!vaultConfig.connection) {
-      throw new BadRequestError({ message: "Vault migration connection is not configured" });
+      throw new BadRequestError({ message: "Vault migration connection is not configured for this namespace" });
     }
 
     const credentials = await decryptAppConnectionCredentials({
@@ -534,6 +589,34 @@ export const externalMigrationServiceFactory = ({
     }
   };
 
+  const deleteVaultExternalMigration = async ({ id, actor }: TDeleteVaultExternalMigrationDTO) => {
+    const { hasRole } = await permissionService.getOrgPermission(
+      actor.type,
+      actor.id,
+      actor.orgId,
+      actor.authMethod,
+      actor.orgId
+    );
+
+    if (!hasRole(OrgMembershipRole.Admin)) {
+      throw new ForbiddenRequestError({ message: "Only admins can delete vault external migration configs" });
+    }
+
+    const config = await vaultExternalMigrationConfigDAL.findById(id);
+
+    if (!config) {
+      throw new NotFoundError({ message: "Vault migration config not found" });
+    }
+
+    if (config.orgId !== actor.orgId) {
+      throw new ForbiddenRequestError({ message: "Config does not belong to this organization" });
+    }
+
+    const deletedConfig = await vaultExternalMigrationConfigDAL.deleteById(id);
+
+    return deletedConfig;
+  };
+
   const getVaultKubernetesAuthRoles = async ({ actor, namespace }: { actor: OrgServiceActor; namespace: string }) => {
     const { hasRole } = await permissionService.getOrgPermission(
       actor.type,
@@ -547,17 +630,17 @@ export const externalMigrationServiceFactory = ({
       throw new ForbiddenRequestError({ message: "Only admins can view vault Kubernetes auth roles" });
     }
 
-    const vaultConfig = await externalMigrationConfigDAL.findOne({
+    const vaultConfig = await vaultExternalMigrationConfigDAL.findOne({
       orgId: actor.orgId,
-      platform: ExternalMigrationProviders.Vault
+      namespace
     });
 
     if (!vaultConfig) {
-      throw new NotFoundError({ message: "Vault migration config not found" });
+      throw new NotFoundError({ message: "Vault migration config not found for this namespace" });
     }
 
     if (!vaultConfig.connection) {
-      throw new BadRequestError({ message: "Vault migration connection is not configured" });
+      throw new BadRequestError({ message: "Vault migration connection is not configured for this namespace" });
     }
 
     const credentials = await decryptAppConnectionCredentials({
@@ -590,8 +673,10 @@ export const externalMigrationServiceFactory = ({
     importEnvKeyData,
     importVaultData,
     hasCustomVaultMigration,
-    configureExternalMigration,
-    getExternalMigrationConfig,
+    createVaultExternalMigration,
+    getVaultExternalMigrationConfigs,
+    updateVaultExternalMigration,
+    deleteVaultExternalMigration,
     getVaultNamespaces,
     getVaultPolicies,
     getVaultMounts,

backend/src/services/external-migration/external-migration-types.ts

@@ -127,8 +127,20 @@ export enum VaultImportStatus {
   ApprovalRequired = "approval_required"
 }
 
-export type TConfigureExternalMigrationDTO = {
-  platform: ExternalMigrationProviders;
+export type TCreateVaultExternalMigrationDTO = {
+  namespace: string;
+  connectionId: string;
+  actor: OrgServiceActor;
+};
+
+export type TUpdateVaultExternalMigrationDTO = {
+  id: string;
+  namespace: string;
   connectionId: string | null;
   actor: OrgServiceActor;
 };
+
+export type TDeleteVaultExternalMigrationDTO = {
+  id: string;
+  actor: OrgServiceActor;
+};

backend/src/services/external-migration/vault-external-migration-config-dal.ts

@@ -1,39 +1,26 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { TableName, TExternalMigrationConfigsInsert } from "@app/db/schemas";
+import { TableName } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { buildFindFilter, ormify, prependTableNameToFindFilter, selectAllTableCols } from "@app/lib/knex";
 
-export type TExternalMigrationConfigDALFactory = ReturnType<typeof externalMigrationConfigDALFactory>;
+export type TVaultExternalMigrationConfigDALFactory = ReturnType<typeof vaultExternalMigrationConfigDALFactory>;
 
-export const externalMigrationConfigDALFactory = (db: TDbClient) => {
-  const orm = ormify(db, TableName.ExternalMigrationConfig);
+export const vaultExternalMigrationConfigDALFactory = (db: TDbClient) => {
+  const orm = ormify(db, TableName.VaultExternalMigrationConfig);
 
-  const upsert = async (data: TExternalMigrationConfigsInsert, tx?: Knex) => {
+  const findOne = async (filter: { orgId: string; namespace: string }, tx?: Knex) => {
     try {
-      const [doc] = await (tx || db)(TableName.ExternalMigrationConfig)
-        .insert(data)
-        .onConflict(["orgId", "platform"])
-        .merge()
-        .returning("*");
-      return doc;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "UpsertExternalMigrationConfig" });
-    }
-  };
-
-  const findOne = async (filter: { orgId: string; platform: string }, tx?: Knex) => {
-    try {
-      const result = await (tx || db?.replicaNode?.() || db)(TableName.ExternalMigrationConfig)
+      const result = await (tx || db?.replicaNode?.() || db)(TableName.VaultExternalMigrationConfig)
         .leftJoin(
           TableName.AppConnection,
           `${TableName.AppConnection}.id`,
-          `${TableName.ExternalMigrationConfig}.connectionId`
+          `${TableName.VaultExternalMigrationConfig}.connectionId`
         )
         /* eslint-disable @typescript-eslint/no-misused-promises */
-        .where(buildFindFilter(prependTableNameToFindFilter(TableName.ExternalMigrationConfig, filter)))
-        .select(selectAllTableCols(TableName.ExternalMigrationConfig))
+        .where(buildFindFilter(prependTableNameToFindFilter(TableName.VaultExternalMigrationConfig, filter)))
+        .select(selectAllTableCols(TableName.VaultExternalMigrationConfig))
         .select(
           db.ref("id").withSchema(TableName.AppConnection).as("appConnectionId"),
           db.ref("name").withSchema(TableName.AppConnection).as("appConnectionName"),
@@ -76,5 +63,5 @@ export const externalMigrationConfigDALFactory = (db: TDbClient) => {
     }
   };
 
-  return { ...orm, upsert, findOne };
+  return { ...orm, findOne };
 };

frontend/src/hooks/api/migration/mutations.tsx

@@ -6,12 +6,7 @@ import { secretKeys } from "@app/hooks/api/secrets/queries";
 
 import { projectKeys } from "../projects";
 import { externalMigrationQueryKeys } from "./queries";
-import {
-  ExternalMigrationProviders,
-  TExternalMigrationConfig,
-  TImportVaultSecretsDTO,
-  VaultImportStatus
-} from "./types";
+import { TImportVaultSecretsDTO, TVaultExternalMigrationConfig, VaultImportStatus } from "./types";
 
 export const useImportEnvKey = () => {
   const queryClient = useQueryClient();
@@ -75,29 +70,6 @@ export const useImportVault = () => {
   });
 };
 
-export const useUpdateExternalMigrationConfig = (platform: ExternalMigrationProviders) => {
-  const queryClient = useQueryClient();
-
-  return useMutation<TExternalMigrationConfig, Error, { connectionId: string | null }>({
-    mutationFn: async ({ connectionId }: { connectionId: string | null }) => {
-      const { data } = await apiRequest.put<{ config: TExternalMigrationConfig }>(
-        "/api/v3/external-migration/config",
-        {
-          connectionId,
-          platform
-        }
-      );
-
-      return data.config;
-    },
-    onSuccess: () => {
-      queryClient.invalidateQueries({
-        queryKey: externalMigrationQueryKeys.config(platform)
-      });
-    }
-  });
-};
-
 export const useImportVaultSecrets = () => {
   const queryClient = useQueryClient();
 
@@ -121,3 +93,73 @@ export const useImportVaultSecrets = () => {
     }
   });
 };
+
+export const useCreateVaultExternalMigrationConfig = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation<
+    TVaultExternalMigrationConfig,
+    Error,
+    { connectionId: string; namespace: string }
+  >({
+    mutationFn: async ({ connectionId, namespace }) => {
+      const { data } = await apiRequest.post<{ config: TVaultExternalMigrationConfig }>(
+        "/api/v3/external-migration/vault/configs",
+        {
+          connectionId,
+          namespace
+        }
+      );
+      return data.config;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: externalMigrationQueryKeys.vaultConfigs()
+      });
+    }
+  });
+};
+
+export const useUpdateVaultExternalMigrationConfig = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation<
+    TVaultExternalMigrationConfig,
+    Error,
+    { id: string; connectionId: string; namespace: string }
+  >({
+    mutationFn: async ({ id, connectionId, namespace }) => {
+      const { data } = await apiRequest.put<{ config: TVaultExternalMigrationConfig }>(
+        `/api/v3/external-migration/vault/configs/${id}`,
+        {
+          connectionId,
+          namespace
+        }
+      );
+      return data.config;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: externalMigrationQueryKeys.vaultConfigs()
+      });
+    }
+  });
+};
+
+export const useDeleteVaultExternalMigrationConfig = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation<TVaultExternalMigrationConfig, Error, { id: string }>({
+    mutationFn: async ({ id }) => {
+      const { data } = await apiRequest.delete<{ config: TVaultExternalMigrationConfig }>(
+        `/api/v3/external-migration/vault/configs/${id}`
+      );
+      return data.config;
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({
+        queryKey: externalMigrationQueryKeys.vaultConfigs()
+      });
+    }
+  });
+};

frontend/src/hooks/api/migration/queries.tsx

@@ -4,7 +4,7 @@ import { apiRequest } from "@app/config/request";
 
 import {
   ExternalMigrationProviders,
-  TExternalMigrationConfig,
+  TVaultExternalMigrationConfig,
   VaultKubernetesAuthRole
 } from "./types";
 
@@ -13,7 +13,7 @@ export const externalMigrationQueryKeys = {
     "custom-migration-available",
     provider
   ],
-  config: (platform: string) => ["external-migration-config", { platform }],
+  vaultConfigs: () => ["vault-external-migration-configs"],
   vaultNamespaces: () => ["vault-namespaces"],
   vaultPolicies: (namespace?: string) => ["vault-policies", namespace],
   vaultMounts: (namespace?: string) => ["vault-mounts", namespace],
@@ -31,19 +31,15 @@ export const useHasCustomMigrationAvailable = (provider: ExternalMigrationProvid
   });
 };
 
-export const useGetExternalMigrationConfig = (platform: string) => {
+export const useGetVaultExternalMigrationConfigs = () => {
   return useQuery({
-    queryKey: externalMigrationQueryKeys.config(platform),
+    queryKey: externalMigrationQueryKeys.vaultConfigs(),
     queryFn: async () => {
-      const { data } = await apiRequest.get<{ config: TExternalMigrationConfig | null }>(
-        "/api/v3/external-migration/config",
-        {
-          params: { platform }
-        }
+      const { data } = await apiRequest.get<{ configs: TVaultExternalMigrationConfig[] }>(
+        "/api/v3/external-migration/vault/configs"
       );
-      return data.config;
-    },
-    enabled: Boolean(platform)
+      return data.configs;
+    }
   });
 };
 

frontend/src/hooks/api/migration/types.ts

@@ -8,10 +8,10 @@ export enum VaultImportStatus {
   ApprovalRequired = "approval_required"
 }
 
-export type TExternalMigrationConfig = {
+export type TVaultExternalMigrationConfig = {
   id: string;
   orgId: string;
-  platform: string;
+  namespace: string;
   connectionId: string | null;
   createdAt: string;
   updatedAt: string;

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx

@@ -37,11 +37,8 @@ import {
   IdentityKubernetesAuthTokenReviewMode,
   IdentityTrustedIp
 } from "@app/hooks/api/identities/types";
-import { useGetExternalMigrationConfig } from "@app/hooks/api/migration/queries";
-import {
-  ExternalMigrationProviders,
-  VaultKubernetesAuthRole
-} from "@app/hooks/api/migration/types";
+import { useGetVaultExternalMigrationConfigs } from "@app/hooks/api/migration/queries";
+import { VaultKubernetesAuthRole } from "@app/hooks/api/migration/types";
 import { usePopUp, UsePopUpState } from "@app/hooks/usePopUp";
 
 import { IdentityFormTab } from "./types";
@@ -130,8 +127,8 @@ export const IdentityKubernetesAuthForm = ({
   const { popUp, handlePopUpToggle: handleImportPopUpToggle } = usePopUp([
     "importFromVault"
   ] as const);
-  const { data: vaultConfig } = useGetExternalMigrationConfig(ExternalMigrationProviders.Vault);
-  const hasVaultConnection = Boolean(vaultConfig?.connectionId);
+  const { data: vaultConfigs = [] } = useGetVaultExternalMigrationConfigs();
+  const hasVaultConnection = vaultConfigs.some((config) => config.connectionId);
 
   const {
     control,

frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultConnectionSection.tsx

@@ -1,100 +1,188 @@
-import { useMemo } from "react";
+import { useState } from "react";
+import { faEdit, faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
 import { createNotification } from "@app/components/notifications";
-import { FilterableSelect, FormControl } from "@app/components/v2";
-import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import {
+  Button,
+  DeleteActionModal,
+  EmptyState,
+  Table,
+  TableContainer,
+  TableSkeleton,
+  TBody,
+  Td,
+  Th,
+  THead,
+  Tr
+} from "@app/components/v2";
 import { useListAppConnections } from "@app/hooks/api/appConnections/queries";
 import {
-  useGetExternalMigrationConfig,
-  useUpdateExternalMigrationConfig
+  useDeleteVaultExternalMigrationConfig,
+  useGetVaultExternalMigrationConfigs
 } from "@app/hooks/api/migration";
-import { ExternalMigrationProviders } from "@app/hooks/api/migration/types";
+import { TVaultExternalMigrationConfig } from "@app/hooks/api/migration/types";
+
+import { VaultNamespaceConfigModal } from "./VaultNamespaceConfigModal";
 
 export const VaultConnectionSection = () => {
-  const { data: appConnections = [], isPending: isLoadingConnections } = useListAppConnections();
+  const [selectedConfig, setSelectedConfig] = useState<TVaultExternalMigrationConfig | null>(null);
+  const [isModalOpen, setIsModalOpen] = useState(false);
+  const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
+  const [configToDelete, setConfigToDelete] = useState<TVaultExternalMigrationConfig | null>(null);
 
-  const vaultConnections = useMemo(
-    () => appConnections.filter((conn) => conn.app === AppConnection.HCVault),
-    [appConnections]
-  );
+  const { data: configs = [], isPending: isLoadingConfigs } = useGetVaultExternalMigrationConfigs();
+  const { data: appConnections = [] } = useListAppConnections();
+  const { mutateAsync: deleteConfig } = useDeleteVaultExternalMigrationConfig();
 
-  const { data: currentConfig, isPending: isLoadingConfig } = useGetExternalMigrationConfig(
-    ExternalMigrationProviders.Vault
-  );
+  const handleEdit = (config: TVaultExternalMigrationConfig) => {
+    setSelectedConfig(config);
+    setIsModalOpen(true);
+  };
 
-  const { mutateAsync: updateConfig, isPending: isUpdating } = useUpdateExternalMigrationConfig(
-    ExternalMigrationProviders.Vault
-  );
+  const handleAdd = () => {
+    setSelectedConfig(null);
+    setIsModalOpen(true);
+  };
+
+  const handleDeleteClick = (config: TVaultExternalMigrationConfig) => {
+    setConfigToDelete(config);
+    setIsDeleteModalOpen(true);
+  };
+
+  const handleDeleteConfirm = async () => {
+    if (!configToDelete) return;
 
-  const handleConnectionChange = async (
-    selectedConnection: { id: string; name: string } | null
-  ) => {
     try {
-      await updateConfig({
-        connectionId: selectedConnection?.id || null
-      });
-
+      await deleteConfig({ id: configToDelete.id });
       createNotification({
         type: "success",
-        text: "Vault connection updated successfully"
+        text: "Namespace configuration deleted successfully"
       });
+      setIsDeleteModalOpen(false);
+      setConfigToDelete(null);
     } catch (error) {
-      console.error("Failed to update vault connection:", error);
+      console.error("Failed to delete namespace config:", error);
       createNotification({
         type: "error",
-        text: "Failed to update vault connection"
+        text: "Failed to delete namespace configuration"
       });
     }
   };
 
-  const selectedConnection = useMemo(() => {
-    if (!currentConfig?.connectionId) return null;
-    return vaultConnections.find((conn) => conn.id === currentConfig.connectionId) || null;
-  }, [currentConfig?.connectionId, vaultConnections]);
-
-  const isLoading = isLoadingConnections || isLoadingConfig;
+  const getConnectionName = (connectionId: string | null) => {
+    if (!connectionId) return "None";
+    const connection = appConnections.find((conn) => conn.id === connectionId);
+    return connection?.name || "Unknown";
+  };
 
   return (
     <div>
-      <div className="mb-4 flex items-center gap-3">
-        <img
-          src="/images/integrations/Vault.png"
-          alt="HashiCorp Vault logo"
-          className="bg-bunker-500 h-10 w-10 rounded-md p-2"
-        />
-        <div>
-          <h3 className="text-mineshaft-100 text-lg font-medium">HashiCorp Vault</h3>
-          <p className="text-sm text-gray-400">
-            Enable in-platform migration tooling for policy imports and secret engine migrations
-          </p>
-        </div>
-      </div>
-
-      <div className="max-w-md">
-        <FormControl
-          label="HashiCorp Vault Connection"
-          tooltipText="Select an existing App Connection to enable in-platform migration features. Manage connections in the App Connections section."
-        >
-          <FilterableSelect
-            value={selectedConnection}
-            onChange={(newValue) => {
-              handleConnectionChange(newValue as { id: string; name: string } | null);
-            }}
-            isLoading={isLoading}
-            isDisabled={isUpdating}
-            options={vaultConnections}
-            placeholder="Select connection..."
-            getOptionLabel={(option) => option.name}
-            getOptionValue={(option) => option.id}
-            isClearable
+      <div className="mb-4 flex items-center justify-between">
+        <div className="flex items-center gap-3">
+          <img
+            src="/images/integrations/Vault.png"
+            alt="HashiCorp Vault logo"
+            className="bg-bunker-500 h-10 w-10 rounded-md p-2"
           />
-        </FormControl>
+          <div>
+            <h3 className="text-mineshaft-100 text-lg font-medium">HashiCorp Vault</h3>
+            <p className="text-sm text-gray-400">
+              Enable in-platform migration tooling for policy imports and secret engine migrations
+            </p>
+          </div>
+        </div>
+        <Button
+          colorSchema="primary"
+          type="submit"
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          onClick={handleAdd}
+        >
+          Add Namespace
+        </Button>
       </div>
 
-      <p className="text-mineshaft-400 mt-2 text-xs">
-        Select an existing App Connection to enable in-platform migration features. Manage
+      <TableContainer>
+        <Table>
+          <THead>
+            <Tr>
+              <Th>Namespace</Th>
+              <Th>Connection</Th>
+              <Th className="w-5" />
+            </Tr>
+          </THead>
+          <TBody>
+            {isLoadingConfigs && (
+              <TableSkeleton columns={3} innerKey="vault-configs-loading" rows={3} />
+            )}
+            {!isLoadingConfigs && configs.length === 0 && (
+              <Tr>
+                <Td colSpan={3}>
+                  <EmptyState title="No namespace configurations" icon={faPlus} className="py-8">
+                    <p className="text-mineshaft-400 mb-4 text-sm">
+                      Add a namespace configuration to enable in-platform migration features.
+                    </p>
+                  </EmptyState>
+                </Td>
+              </Tr>
+            )}
+            {!isLoadingConfigs &&
+              configs.map((config) => (
+                <Tr key={config.id} className="group h-10">
+                  <Td>{config.namespace}</Td>
+                  <Td>{getConnectionName(config.connectionId)}</Td>
+                  <Td>
+                    <div className="flex items-center justify-end gap-2 opacity-0 transition-opacity group-hover:opacity-100">
+                      <Button
+                        variant="plain"
+                        colorSchema="secondary"
+                        size="xs"
+                        onClick={() => handleEdit(config)}
+                        leftIcon={<FontAwesomeIcon icon={faEdit} />}
+                      >
+                        Edit
+                      </Button>
+                      <Button
+                        variant="plain"
+                        colorSchema="danger"
+                        size="xs"
+                        onClick={() => handleDeleteClick(config)}
+                        leftIcon={<FontAwesomeIcon icon={faTrash} />}
+                      >
+                        Delete
+                      </Button>
+                    </div>
+                  </Td>
+                </Tr>
+              ))}
+          </TBody>
+        </Table>
+      </TableContainer>
+
+      <p className="text-mineshaft-400 mt-4 text-xs">
+        Configure namespace-specific connections to enable in-platform migration features. Manage
         connections in the App Connections section.
       </p>
+
+      <VaultNamespaceConfigModal
+        isOpen={isModalOpen}
+        onOpenChange={(open) => {
+          setIsModalOpen(open);
+          if (!open) setSelectedConfig(null);
+        }}
+        editConfig={selectedConfig || undefined}
+      />
+
+      <DeleteActionModal
+        isOpen={isDeleteModalOpen}
+        title={`Delete namespace configuration for "${configToDelete?.namespace}"?`}
+        onChange={(open) => {
+          setIsDeleteModalOpen(open);
+          if (!open) setConfigToDelete(null);
+        }}
+        deleteKey="confirm"
+        onDeleteApproved={handleDeleteConfirm}
+      />
     </div>
   );
 };

frontend/src/pages/organization/SettingsPage/components/ExternalMigrationsTab/components/VaultNamespaceConfigModal.tsx

@@ -0,0 +1,187 @@
+import { useEffect, useMemo } from "react";
+import { Controller, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import { createNotification } from "@app/components/notifications";
+import {
+  Button,
+  FilterableSelect,
+  FormControl,
+  Input,
+  Modal,
+  ModalContent
+} from "@app/components/v2";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import { useListAppConnections } from "@app/hooks/api/appConnections/queries";
+import {
+  useCreateVaultExternalMigrationConfig,
+  useUpdateVaultExternalMigrationConfig
+} from "@app/hooks/api/migration";
+import { TVaultExternalMigrationConfig } from "@app/hooks/api/migration/types";
+
+const schema = z.object({
+  namespace: z.string().min(1, "Namespace is required"),
+  connectionId: z.string().min(1, "Connection is required")
+});
+
+type FormData = z.infer<typeof schema>;
+
+type Props = {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  editConfig?: TVaultExternalMigrationConfig;
+};
+
+export const VaultNamespaceConfigModal = ({ isOpen, onOpenChange, editConfig }: Props) => {
+  const isEdit = Boolean(editConfig);
+
+  const { data: appConnections = [], isPending: isLoadingConnections } = useListAppConnections();
+
+  const vaultConnections = useMemo(
+    () => appConnections.filter((conn) => conn.app === AppConnection.HCVault),
+    [appConnections]
+  );
+
+  const { mutateAsync: createConfig, isPending: isCreating } =
+    useCreateVaultExternalMigrationConfig();
+  const { mutateAsync: updateConfig, isPending: isUpdating } =
+    useUpdateVaultExternalMigrationConfig();
+
+  const {
+    control,
+    handleSubmit,
+    reset,
+    formState: { errors, isSubmitting }
+  } = useForm<FormData>({
+    resolver: zodResolver(schema),
+    defaultValues: {
+      namespace: "",
+      connectionId: ""
+    }
+  });
+
+  // Reset form when editConfig changes or modal opens
+  useEffect(() => {
+    if (isOpen) {
+      reset({
+        namespace: editConfig?.namespace || "",
+        connectionId: editConfig?.connectionId || ""
+      });
+    }
+  }, [isOpen, editConfig, reset]);
+
+  const onFormSubmit = async (data: FormData) => {
+    try {
+      if (isEdit && editConfig) {
+        await updateConfig({
+          id: editConfig.id,
+          namespace: data.namespace,
+          connectionId: data.connectionId
+        });
+        createNotification({
+          type: "success",
+          text: "Namespace configuration updated successfully"
+        });
+      } else {
+        await createConfig({
+          namespace: data.namespace,
+          connectionId: data.connectionId
+        });
+        createNotification({
+          type: "success",
+          text: "Namespace configuration created successfully"
+        });
+      }
+      reset();
+      onOpenChange(false);
+    } catch (error) {
+      console.error("Failed to save namespace config:", error);
+      createNotification({
+        type: "error",
+        text: `Failed to ${isEdit ? "update" : "create"} namespace configuration`
+      });
+    }
+  };
+
+  const handleClose = () => {
+    reset();
+    onOpenChange(false);
+  };
+
+  return (
+    <Modal isOpen={isOpen} onOpenChange={handleClose}>
+      <ModalContent
+        title={isEdit ? "Edit Namespace Configuration" : "Add Namespace Configuration"}
+        subTitle={`Configure a HashiCorp Vault namespace ${isEdit ? "configuration" : "for migration tooling"}`}
+        bodyClassName="overflow-visible"
+      >
+        <form onSubmit={handleSubmit(onFormSubmit)}>
+          <Controller
+            control={control}
+            name="namespace"
+            render={({ field }) => (
+              <FormControl
+                label="Namespace"
+                isError={Boolean(errors.namespace)}
+                errorText={errors.namespace?.message}
+                className="mb-4"
+              >
+                <Input {...field} placeholder="e.g., admin, dev, prod" autoComplete="off" />
+              </FormControl>
+            )}
+          />
+
+          <Controller
+            control={control}
+            name="connectionId"
+            render={({ field }) => {
+              const selectedConnection = vaultConnections.find((conn) => conn.id === field.value);
+
+              return (
+                <FormControl
+                  label="Vault Connection"
+                  isError={Boolean(errors.connectionId)}
+                  errorText={errors.connectionId?.message}
+                  tooltipText="Select a HashiCorp Vault app connection for this namespace"
+                >
+                  <FilterableSelect
+                    value={selectedConnection || null}
+                    onChange={(newValue) => {
+                      const singleValue = Array.isArray(newValue) ? newValue[0] : newValue;
+                      if (singleValue && "id" in singleValue) {
+                        field.onChange(singleValue.id);
+                      } else {
+                        field.onChange("");
+                      }
+                    }}
+                    isLoading={isLoadingConnections}
+                    options={vaultConnections}
+                    placeholder="Select connection..."
+                    getOptionLabel={(option) => option.name}
+                    getOptionValue={(option) => option.id}
+                  />
+                </FormControl>
+              );
+            }}
+          />
+
+          <div className="mt-8 flex items-center gap-2">
+            <Button
+              className="mr-4"
+              size="sm"
+              type="submit"
+              isLoading={isSubmitting || isCreating || isUpdating}
+              isDisabled={isSubmitting || isCreating || isUpdating}
+            >
+              {isEdit ? "Update" : "Create"}
+            </Button>
+            <Button colorSchema="secondary" variant="plain" onClick={handleClose}>
+              Cancel
+            </Button>
+          </div>
+        </form>
+      </ModalContent>
+    </Modal>
+  );
+};

frontend/src/pages/project/RoleDetailsBySlugPage/components/AddPoliciesButton.tsx

@@ -12,8 +12,7 @@ import {
 import { useOrgPermission } from "@app/context";
 import { OrgMembershipRole } from "@app/helpers/roles";
 import { usePopUp } from "@app/hooks";
-import { useGetExternalMigrationConfig } from "@app/hooks/api/migration";
-import { ExternalMigrationProviders } from "@app/hooks/api/migration/types";
+import { useGetVaultExternalMigrationConfigs } from "@app/hooks/api/migration";
 import { ProjectType } from "@app/hooks/api/projects/types";
 import { PolicySelectionModal } from "@app/pages/project/RoleDetailsBySlugPage/components/PolicySelectionModal";
 import { PolicyTemplateModal } from "@app/pages/project/RoleDetailsBySlugPage/components/PolicyTemplateModal";
@@ -33,9 +32,8 @@ export const AddPoliciesButton = ({ isDisabled, projectType }: Props) => {
   ] as const);
 
   const { hasOrgRole } = useOrgPermission();
-  const { data: vaultConfig } = useGetExternalMigrationConfig(ExternalMigrationProviders.Vault);
-
-  const hasVaultConnection = Boolean(vaultConfig?.connectionId);
+  const { data: vaultConfigs = [] } = useGetVaultExternalMigrationConfigs();
+  const hasVaultConnection = vaultConfigs.some((config) => config.connectionId);
   const isOrgAdmin = hasOrgRole(OrgMembershipRole.Admin);
   const isVaultImportDisabled = isDisabled || !isOrgAdmin;
 

frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/ActionBar.tsx

@@ -77,8 +77,11 @@ import {
   fetchDashboardProjectSecretsByKeys
 } from "@app/hooks/api/dashboard/queries";
 import { UsedBySecretSyncs } from "@app/hooks/api/dashboard/types";
-import { useGetExternalMigrationConfig, useImportVaultSecrets } from "@app/hooks/api/migration";
-import { ExternalMigrationProviders, VaultImportStatus } from "@app/hooks/api/migration/types";
+import {
+  useGetVaultExternalMigrationConfigs,
+  useImportVaultSecrets
+} from "@app/hooks/api/migration";
+import { VaultImportStatus } from "@app/hooks/api/migration/types";
 import { secretApprovalRequestKeys } from "@app/hooks/api/secretApprovalRequest/queries";
 import { PendingAction } from "@app/hooks/api/secretFolders/types";
 import { fetchProjectSecrets, secretKeys } from "@app/hooks/api/secrets/queries";
@@ -198,8 +201,8 @@ export const ActionBar = ({
   const isMultiSelectActive = Boolean(Object.keys(selectedSecrets).length);
 
   const { permission } = useProjectPermission();
-  const { data: vaultConfig } = useGetExternalMigrationConfig(ExternalMigrationProviders.Vault);
-  const hasVaultConnection = Boolean(vaultConfig?.connectionId);
+  const { data: vaultConfigs = [] } = useGetVaultExternalMigrationConfigs();
+  const hasVaultConnection = vaultConfigs.some((config) => config.connectionId);
 
   const handleFolderCreate = async (folderName: string, description: string | null) => {
     try {