Operational Model using Hashicorp Vault
This is to create an operational task to pass it to operator. For example, SSH to host.
Vault Admin creates AppRole (role_id), pass role_id to Operator as operational task reference id
Vault Admin creates Admin Token (admin_token), pass it to App Token Admin
Now, Operator has a operational task reference id, role_id.
Task Requester submit request to Operator
Operator submit the request to App Token Admin
App Token Admin uses Admin Token against AppRole to create Secret ID (secret_id), pass it to Operator
Operator use role_id and secret_id login to retrieve App token, and retrieve credential, such as signed public key in SSH case
Operator pass credential to Task Performer
Then complete change task.
- Vault Admin - can access vault to generate root token
- App Token Admin - manage App operations
- Operator - manage and issue AppRole credentials
- Task Requester - Change requester
- Task Performer - Change implemenator
Token or Keys
Root Token - Manage Vault
App Token - Manage App, for example, SSH App as whole
Role ID - Identify AppRole, for example, Project or Host
Secret ID - Retrieve Task Token
Task Token - Retrieve credential
Root Token should be revoken after used
App Token should be securely managed
Secret ID and Task Token should have short life
Secret ID and Task Token should be held by operator or task performer, this can be decided by how AppRole managed. If AppRole cannot restrict the task to be performed, then only can pass credential to task performer.
In order to identify the host, the Host Key Signing mentioned in following page should be considered.
There is no clear info on the machines managed.