Vault/Install

Vault是一套由HashiCorp開發的密碼管理軟體。

概要

Vault可以拿來存放各類credential資料，像是Key或是Password。

安裝

Vault是單執行檔，建議安裝的路徑是/usr/local/bin/vault，這點沒有在官方的文件裡提到，但官方的範例常使用這個路徑。

以Linux版的例子來說：

cd /tmp; wget -c https://releases.hashicorp.com/vault/1.4.3/vault_1.4.3_linux_amd64.zip; unzip vault_1.4.3_linux_amd64.zip; sudo cp vault /usr/local/bin/vault; sudo chmod 755 /usr/local/bin/vault

設定

這邊是設定成：

• 使用AWS KMS加解密。
• 使用Amazon DynamoDB當作儲存空間。

AWS

DynamoDB

依照官方的建議：

• Primary partition key設為Path（string）。
• Primary sort key設為Key（string）。

KMS

使用SYMMETRIC_DEFAULT即可。

IAM

掛入對應的Inline Policy Policy-Vault-DynamoDB：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "dynamodb:BatchGetItem",
                "dynamodb:BatchWriteItem",
                "dynamodb:PutItem",
                "dynamodb:DescribeTable",
                "dynamodb:DeleteItem",
                "dynamodb:GetItem",
                "dynamodb:Scan",
                "dynamodb:ListTagsOfResource",
                "dynamodb:Query",
                "dynamodb:UpdateItem",
                "dynamodb:DescribeTimeToLive",
                "dynamodb:GetRecords"
            ],
            "Resource": [
                "arn:aws:dynamodb:ap-southeast-1:123456789012:table/vault/stream/*",
                "arn:aws:dynamodb:ap-southeast-1:123456789012:table/vault/index/*",
                "arn:aws:dynamodb:ap-southeast-1:123456789012:table/vault"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "dynamodb:DescribeReservedCapacityOfferings",
                "dynamodb:ListTables",
                "dynamodb:DescribeReservedCapacity",
                "dynamodb:DescribeLimits"
            ],
            "Resource": "*"
        }
    ]
}

以及Policy-Vault-KMS：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:DescribeKey"
            ],
            "Resource": "arn:aws:kms:ap-southeast-1:123456789012:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
        }
    ]
}

/etc/vault.d/vault.hcl

Vault的設定檔建議的路徑是/etc/vault.d/vault.hcl，這點沒有在官方的文件裡提到，但官方的範例常使用這個路徑。

api_addr = "http://10.10.10.10:8200"
cluster_addr = "http://10.10.10.10:8201"
log_level = "Info"

listener "tcp" {    
  address         = "0.0.0.0:8200"
  cluster_address = "10.10.10.10:8201"
  tls_disable     = "true"
}

seal "awskms" {
  region     = "ap-southeast-1"
  access_key = "x"
  secret_key = "x"
  kms_key_id = "x"
}

storage "dynamodb" {
  ha_enabled = "true"
  region     = "ap-southeast-1"
  table      = "vault"
  access_key = "x"
  secret_key = "x"
}

外部連結

• 官方網站 （英文）