Secret Management with Vault

Re:Secret Management with Vault by doublerebel on Friday October 28, 2016 @06:18PM (#12821249)

Have the temp token generated as part of the deployment process. This temp token can be shown in plaintext to the developer/CD machine/Chef/logs because it is use- and time- limited. If anything besides the new app uses the temp token, the deployment will fail and the token usage can be easily traced to the offender.

Regarding machine- or user- oriented, it just depends on whether you trust the deployer (user) or the deployment machine to authorize a new temp token.

[ Parent | on HN ]

Re:Secret Management with Vault by tonyarkles on Friday October 28, 2016 @06:59PM (#12821492)

A client of mine has a number of windows machines, and a well-organized Active Directory setup. The small group of users who need to be able to create deployment tokens are all in an AD group, and it was pretty straightforward to use the LDAP auth backend with vault to allow them to create those one-time use tokens using their normal network logins. Everyone's super impressed so far.

[ Parent | on HN ]

Re:Secret Management with Vault by OhSoHumble on Friday October 28, 2016 @06:52PM (#12821447)

I'll look into this more. I'm a simple guy so hopefully my initial forays produce fruit easily. Maybe I'll luck out and there will be a blog post from someone on how to implement this specifically with AWS and Chef.

[ Parent | on HN ]

Re:Secret Management with Vault by empath75 on Friday October 28, 2016 @07:49PM (#12821738)

There's an AWS based auth method based on iam roles and ami ids. Takes a few minutes to set up.

https://www.vaultproject.io/docs/auth/aws-ec2.html

[ Parent | on HN ]

Re:Secret Management with Vault by bogomipz on Friday October 28, 2016 @06:28PM (#12821314)

I see, that makes sense. Thanks for the good explanation.

[ Parent | on HN ]