Robert Main
18f469105c
* Update website folder to indicate deprecation Adds an alert banner to the top of all MDX files within `/website` to indicate deprecation * Update website README
114 lines
6.0 KiB
Plaintext
114 lines
6.0 KiB
Plaintext
---
|
||
layout: docs
|
||
page_title: Manage static credentials with Vault
|
||
description: >-
|
||
Create a Vault credential store to manage credentials. Credential stores let you configure targets for credential brokering or credential injection.
|
||
---
|
||
|
||
⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
|
||
> [!IMPORTANT]
|
||
> **Documentation Update:** Product documentation previously located in `/website` has moved to the [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs) repository, where all product documentation is now centralized. Please make contributions directly to `web-unified-docs`, since changes to `/website` in this repository will not appear on developer.hashicorp.com.
|
||
⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
|
||
|
||
# Create a Vault credential store
|
||
|
||
You can manage credentials in Boundary using [credential stores](/boundary/docs/domain-model/credential-stores), which are resources that store credentials for various targets.
|
||
Vault credential stores point to a HashiCorp Vault instance, which provides capabilities like generating short-lived dynamic credentials.
|
||
|
||
## Requirements
|
||
|
||
- You must have a Vault instance available with an address or URL that is reachable from your Boundary instance. This will be used to connect Boundary to Vault.
|
||
- You must have static credentials stored in Vault’s key/value secrets engine. Examples of static credential types include username password or username and SSH private key.
|
||
- You must have a Vault token for Boundary to authenticate and access your static credentials.
|
||
|
||
## Configuration
|
||
|
||
Complete the following steps to create a Vault credential store:
|
||
|
||
<Tabs>
|
||
<Tab heading="UI" group="ui">
|
||
|
||
1. Log in to Boundary.
|
||
1. Select **Orgs** on the navigation pane.
|
||
1. Select your desired org.
|
||
1. Select the project to which your static credential store should belong.
|
||
1. Select **Credential Stores** on the navigation pane.
|
||
1. Select **New Credential Store**.
|
||
1. Provide a name for your credential store and select type **Vault**.
|
||
1. Complete the fields related to your Vault instance:
|
||
- **Address** - The address of your Vault instance.
|
||
- **Worker Filter** (optional) - If your Vault instance does not have a publicly accessible address and instead is proxied through a Boundary worker, enter the worker filter. This should be a boolean expression. To generate a worker filter in the correct format, toggle the **Show filter generator** switch. Refer to the examples in the [Worker tags](/boundary/docs/workers/worker-tags) documentation.
|
||
- **Token** - Token provided by Vault that provides access to the static credentials within your Vault instance.
|
||
- **Namespace** (optional) - Vault namespace. Requires Vault Enterprise.
|
||
- **TLS Server Name** (optional) - Name to use as the SNI host if you connect to Vault via TLS.
|
||
- **Client Certificate** (optional) - A PEM-encoded client certificate to use for TLS authentication to the Vault server.
|
||
- **Client Certificate key** (optional) - A PEM-encoded private key that matches the client certificate from client certificate.
|
||
- **CA Certificate** (optional) - A PEM-encoded CA certificate to verify the Vault server's TLS certificate.
|
||
|
||
1. Click **Save**. You now have a static credential store where you can store static credentials.
|
||
1. In your newly created Vault credential store, click on the **Credential Libraries** tab.
|
||
1. Click **Manage**, and then select **New Credential Library** in the pull down menu.
|
||
1. Complete the fields related to the static credentials stored in your Vault instance:
|
||
- **Name** (optional) - The name is optional, but if you enter a name, it must be unique within the parent credential store.
|
||
- **Type** - Select **Generic Secrets**.
|
||
- **Vault Path** - Enter the path for the location of your static credentials stored in Vault. Boundary uses this field to locate the static credentials inside Vault.
|
||
- **Credential Type** - Select the appropriate credential type that matches the static credential stored in Vault.
|
||
- **HTTP Method** - Select **GET**.
|
||
1. Click **Save**.
|
||
|
||
</Tab>
|
||
<Tab heading="CLI" group="cli">
|
||
|
||
1. Log into Boundary.
|
||
|
||
```shell-session
|
||
$ boundary authenticate
|
||
Please enter the login name (it will be hidden):
|
||
Please enter the password (it will be hidden):
|
||
```
|
||
|
||
1. Create a credential store and provide a name and project ID.
|
||
|
||
```shell-session
|
||
$ boundary credential-stores create vault \
|
||
-scope-id p_VHAKTCEKcU \
|
||
-name "vault-cred-store-test"
|
||
```
|
||
|
||
1. Create a credential library using one of the following commands, based on the type of credential.
|
||
|
||
- For username password credentials:
|
||
|
||
```shell-session
|
||
$ boundary credential-libraries create vault-generic \
|
||
-name "vault-cred-lib-test" \
|
||
-credential-store-id csvlt_Xqa6V6QwfM \
|
||
-credential-type username_password \
|
||
-vault-path "path/to/vault/credentials"
|
||
```
|
||
|
||
- For username private key credentials:
|
||
|
||
```shell-session
|
||
$ boundary credential-libraries create vault-generic \
|
||
-name "vault-cred-lib-test" \
|
||
-credential-store-id csvlt_Xqa6V6QwfM \
|
||
-credential-type ssh_private_key \
|
||
-vault-path "path/to/vault/credentials"
|
||
```
|
||
|
||
</Tab>
|
||
</Tabs>
|
||
|
||
## More information
|
||
|
||
Refer to [Filtering and listing resources](/boundary/docs/filtering) for more information about Boundary's filter syntax and best practices.
|
||
|
||
## Next steps
|
||
|
||
Once you have created a credential store, you can configure targets for credential brokering or credential injection.
|
||
When you use credential brokering, Boundary centrally manages credentials and returns them to the user when they attempt to connect to a target.
|
||
Credential injection requires HCP Boundary or Boundary Enterprise, and it provides end users with a passwordless experience when they connect to targets.
|
||
|
||
- [Configure a target for credential brokering](/boundary/docs/credentials/configure-credential-brokering)
|
||
- [Configure a target for credential injection](/boundary/docs/credentials/configure-credential-brokering) |