Correlate findings with Vault

When the Vault Radar agent connects to a Vault Dedicated or Vault Enterprise cluster, Vault Radar can correlate findings with secrets stored in Vault. This allows you to identify what secrets you need to rotate.

Connect a Vault cluster

Before you can correlate findings with Vault, you need to deploy the Radar agent. Once you deploy the agent, you can configure and connect Vault to the agent.

Prerequisites

You need one of the following Vault authentication methods:

• Kubernetes
• AppRole
• Token

The authentication methods require a policy that allows the Vault Radar agent to read all KV secrets from Vault.

Create a Vault policy

Vault Radar requires the following capabilities:

• Validate tokens (using self-lookup API)
• List and read all namespaces
• List all auth methods and mounts in each namespace
• List all secrets in a KV secrets engine mount
• Read all the versions of a secret in a KV secret engine mount

A policy granting just the required level of access requires explicitly specifying the namespaces and KV mounts.

path "auth/token/lookup-self" {
    capabilities = ["read"]
}

path "sys/license/status" {
    capabilities = ["read"]
}

# Assumption: Namespaces are atmost 2 levels deep
path "sys/namespaces/*" {
    capabilities = ["read", "list"]
}

path "+/sys/namespaces/*" {
    capabilities = ["read", "list"]
}

path "+/+/sys/namespaces/*" {
    capabilities = ["read", "list"]
}

path "sys/auth" {
    capabilities = ["read"]
}

path "+/sys/auth" {
    capabilities = ["read"]
}

path "+/+/sys/auth" {
    capabilities = ["read"]
}

path "sys/mounts" {
    capabilities = ["read"]
}

path "+/sys/mounts" {
    capabilities = ["read"]
}

path "+/+/sys/mounts" {
    capabilities = ["read"]
}

# Assumption: KV secret engine mounts are atmost 2 levels deep
path "+/metadata/*" {
    capabilities = ["read", "list"]
}

path "+/+/metadata/*" {
    capabilities = ["read", "list"]
}

path "+/+/+/metadata/*" {
    capabilities = ["read", "list"]
}

path "+/+/+/+/metadata/*" {
    capabilities = ["read", "list"]
}

path "+/data/*" {
    capabilities = ["read"]
}

path "+/+/data/*" {
    capabilities = ["read"]
}

path "+/+/+/data/*" {
    capabilities = ["read"]
}

path "+/+/+/+/data/*" {
    capabilities = ["read"]
}

For less restrictive environments, you can give broader permissions to Vault Radar.

A simple policy that grants Vault Radar broad access to your Vault cluster.

path "*" {
    capabilities = ["read", "list"]
}

Agent configuration with Vault

Set up and manage a Vault cluster from the Vault Radar module in the HCP Portal. Select Settings, then Secret Managers, and then click Connect new secret manager.

1. Select Vault and the Vault deployment type
2. Provide you Vault cluster URL
3. Select auth method and fill in details on the form, and select Next to validate the connection.