Create a Vault credential store

Create a Vault credential store

출처: HashiCorp Boundary docs

This page shows you how to connect an existing Vault instance to Boundary as a Vault credential store, so you can use Vault-managed credentials, including short-lived dynamic credentials, to broker or inject access into your targets. It assumes Vault is already configured with your static credentials.

Requirements

  • You must have a Vault instance available with an address or URL that is reachable from your Boundary instance. This will be used to connect Boundary to Vault.
  • You must have static credentials stored in Vault’s key/value secrets engine. Examples of static credential types include username password, username password domain, and SSH private key.
  • You must have a Vault token for Boundary to authenticate and access your static credentials.

Create the Vault credential store

Complete the following steps to create a Vault credential store: UI CLI Terraform

  • Address - The address of your Vault instance.Worker Filter (optional) - If your Vault instance does not have a publicly accessible address and instead is proxied through a Boundary worker, enter the worker filter. The filter should be a boolean expression. To have Boundary format the filter for you, click the Show filter generator toggle. Refer to Generate a filter in the Admin UI for the procedure, or the examples in the Worker tags documentation.Token - Token provided by Vault that provides access to the static credentials within your Vault instance.Namespace (optional) - Vault namespace. Requires Vault Enterprise.TLS Server Name (optional) - Name to use as the SNI host if you connect to Vault via TLS.Client Certificate (optional) - A PEM-encoded client certificate to use for TLS authentication to the Vault server.Client Certificate key (optional) - A PEM-encoded private key that matches the client certificate from client certificate.CA Certificate (optional) - A PEM-encoded CA certificate to verify the Vault server's TLS certificate.

  • Name (optional) - The name is optional, but if you enter a name, it must be unique within the parent credential store.Type - Select Generic Secrets.Vault Path - Enter the path for the location of your static credentials stored in Vault. Boundary uses this field to locate the static credentials inside Vault.Credential Type - Select the appropriate credential type that matches the static credential stored in Vault.HTTP Method - Select GET.

$ boundary authenticate Please enter the login name (it will be hidden): Please enter the password (it will be hidden):

- ```
$ boundary credential-stores create vault \
    -scope-id p_VHAKTCEKcU \
    -name "vault-cred-store-test"


  • $ boundary credential-libraries create vault-generic \
  -name "vault-cred-lib-test" \
  -credential-store-id csvlt_Xqa6V6QwfM \
  -credential-type username_password \
  -vault-path "path/to/vault/credentials"


  $ boundary credential-libraries create vault-generic \
    -name "vault-cred-lib-test" \
    -credential-store-id csvlt_Xqa6V6QwfM \
    -credential-type username-password-domain \
    -vault-path "path/to/vault/credentials"

$ boundary credential-libraries create vault-generic
-name "vault-cred-lib-test"
-credential-store-id csvlt_Xqa6V6QwfM
-credential-type ssh_private_key
-vault-path "path/to/vault/credentials"


Apply the following Terraform configuration to create a Vault credential store and add two types of credential libraries to it.

resource "boundary_credential_store_vault" "example" { name = "example_vault_credential_store" description = "My first Vault credential store!" address = "http://127.0.0.1:8200" token = "s.0ufRo6XEGU2jOqnIr7OlFYP5" scope_id = boundary_scope.project.id }

Username/password credential library

resource "boundary_credential_library_vault" "baz" { name = "baz" description = "vault username password credential with mapping overrides" credential_store_id = boundary_credential_store_vault.example.id path = "my/secret/baz" http_method = "GET" credential_type = "username_password"

optional

credential_mapping_overrides = { password_attribute = "alternative_password_label" username_attribute = "alternative_username_label" } }

SSH private key credential library

resource "boundary_credential_library_vault" "quz" { name = "quz" description = "vault ssh private key credential with mapping overrides" credential_store_id = boundary_credential_store_vault.example.id path = "my/secret/quz" http_method = "GET" credential_type = "ssh_private_key"

optional

credential_mapping_overrides = { private_key_attribute = "alternative_key_label" private_key_passphrase_attribute = "alternative_passphrase_label" username_attribute = "alternative_username_label" } }


## More information

Refer to Filtering and listing resources for more information about Boundary's filter syntax and best practices.

## Next steps

Once you have created a credential store, you can configure targets for credential brokering or credential injection.
When you use credential brokering, Boundary centrally manages credentials and returns them to the user when they attempt to connect to a target.
Credential injection provides end users with a passwordless experience when they connect to targets.

- Configure a target for credential brokering
- Configure a target for credential injection

Edit this page on GitHub