Operational Model using Hashicorp Vault

Steps

Preprepation

This is to create an operational task to pass it to operator. For example, SSH to host.

• Vault Admin creates AppRole (role_id), pass role_id to Operator as operational task reference id

• Vault Admin creates Admin Token (admin_token), pass it to App Token Admin

Now, Operator has a operational task reference id, role_id.

Change request

• Task Requester submit request to Operator

• Operator submit the request to App Token Admin

• App Token Admin uses Admin Token against AppRole to create Secret ID (secret_id), pass it to Operator

• Operator use role_id and secret_id login to retrieve App token, and retrieve credential, such as signed public key in SSH case

• Operator pass credential to Task Performer

• Then complete change task.

Roles

• Vault Admin - can access vault to generate root token
• App Token Admin - manage App operations
• Operator - manage and issue AppRole credentials
• Task Requester - Change requester
• Task Performer - Change implemenator

Token or Keys

Root Token - Manage Vault
App Token - Manage App, for example, SSH App as whole
Role ID - Identify AppRole, for example, Project or Host
Secret ID - Retrieve Task Token
Task Token - Retrieve credential

Root Token should be revoken after used
App Token should be securely managed
Secret ID and Task Token should have short life

Other consideration

Secret ID and Task Token should be held by operator or task performer, this can be decided by how AppRole managed. If AppRole cannot restrict the task to be performed, then only can pass credential to task performer.

In order to identify the host, the Host Key Signing mentioned in following page should be considered.

Signed SSH Certificates

Cons

There is no clear info on the machines managed.

References

Admin Token for AppRole in Hashicorp Vault