HashiCorp Vault

Day Two Cloud 090: Winging it with HashiCorp Vault

Posted on by nedbellavance

This episode of Day Two Cloud featured yours truly talking Ethan through the world of HashiCorp Vault. It sprung from some conversations we’d had earlier about how he could better secure the secrets and API keys he uses in his Python scripts. We had a last minute guest cancellation, so we decided to wing it and do a whole episode without a script. I think it went well! In part because Ethan is an excellent interviewer, and also because all the Vault knowledge was fresh in my head. There is one thing that bothers me about the episode, and it’s too late to change it now. It’s about the master key.

Continue reading “Day Two Cloud 090: Winging it with HashiCorp Vault” →

Use HashiCorp Vault AWS engine with multiple accounts

Posted on by nedbellavance

I received a question recently on how to properly configure the AWS secrets engine on HashiCorp Vault to work with multiple AWS accounts. It took me a bit, but I did figure out how to do it and what the limitations are. In this post, I will break down how the secrets engine works and how to use it to dynamically create credentials across multiple AWS accounts using the assume_role feature.

Continue reading “Use HashiCorp Vault AWS engine with multiple accounts” →

Using Azure Active Directory Authentication with HashiCorp Vault – Part 2

Posted on by nedbellavance

This is the second and probably final post in this series. If you haven’t read the first post I would highly recommend it. When we last left our erstwhile heroes, they had successfully setup the Azure authentication method on a Vault server and created a policy associated with a role in the Azure auth method. The policy grants access to a key-value store called webkv. Now comes the fun part, how does an Azure VM go about using the Azure auth method to access the secrets stored in webkv? So glad you asked!

Continue reading “Using Azure Active Directory Authentication with HashiCorp Vault – Part 2” →

Using Azure Active Directory Authentication with HashiCorp Vault – Part 1

Posted on by nedbellavance

I am currently working on a Getting Started course for HashiCorp’s Vault product. There was a pretty cool demo I put together for using Azure AD as an authentication source for Vault, but unfortunately I had to cut it for sake of time. I didn’t want it to go to waste though; so I figured I’d write about it here instead. Here’s what we’re going to do. Use the Managed Service Identity feature in Azure to give an Azure VM permissions to access secrets in Vault. This is the sort of thing that could be applied to anything that can receive an MSI in Azure, including App Service, Functions, VMSS, and more!

Continue reading “Using Azure Active Directory Authentication with HashiCorp Vault – Part 1” →