Remediate leaked AWS secrets

HCP Vault Radar can scan for leaked Amazon Web Services (AWS) secrets using dynamic secrets, for a tutorial on how to use statics secrets, go to active secrets documentation.

Create an incident

Leaked secrets can lead to unauthorized access to your services. To prevent malicious activity, HashiCorp recommends users to rotate and store the secret in Vault.

• Follow your organization’s guidelines for emergency rotation of a secret.
• Contact your AWS account owner.
• Determine if your company already uses HashiCorp Vault.

Configure Vault's AWS secret engine

This example uses the AWS secrets engine and IAM auth method. If your application is already configured to access secrets in Vault, use existing secrets engines and auth methods. Click here for more information on AWS secret engine.

1. Create an AWS policy with the permissions that your app needs to use AWS services. For more information about AWS policies, please refer to this document.

1. Set the following environment variables in your local environment:

   VAULT_TOKEN
   VAULT_ADDR
   VAULT_NAMESPACE
   AWS_ACCESS_KEY_ID
   AWS_SECRET_ACCESS_KEY
   

2. Enable the AWS secret engine in Vault.

   $ vault secrets enable aws
   

   Note

   This command will default to aws/ as the path. You can specify any other path but make sure to change the path of the example commands.

3. Configure the root credentials.

   $ vault write aws/config/root access_key=${AWS_ACCESS_KEY} secret_key=${AWS_SECRET_KEY}
   

   Note

   Find the necessary permissions for Vault to create dynamic AWS IAM users here. For more details on how to configure root credentials, refer to Vault docs

4. Create an IAM role with a policy. This IAM role needs to match the permissions required on AWS. For example, to create a Vault role to grant full access to AWS EC2 service, the command should look like this:

   $ vault write aws/roles/my-role \
      credential_type=iam_user \
         policy_document=-<<EOF
            {
               "Version": "2012-10-17",
               "Statement": [
                  {
                     "Effect": "Allow",
                     "Action": "ec2:*",
                     "Resource": "*"
                  }
               ]
            }
         EOF
   

1. Validate the access by trying to read a secret.

   $ vault read aws/creds/my-role
   

Remove the secret from code

Now that the AWS secret is available from Vault, remove the hardcoded secret from the source code. This example uses an environment variable to store the secret from Vault.

1. Create an environment variable with the secret from Vault.

   $ export MY_SECRET=$(curl \
    --header "X-Vault-Token: ..." \
    http://127.0.0.1:8200/v1/aws/static-creds/{my-role})
   

2. Remove the secret from source and add a reference to the secret stored at the environment variable MY_SECRET.

   mySecret = getenv(“MY_SECRET”)
   

3. Start your local server and test.

Revoke the secret

Revoke the secret to complete the remediation process.

• Validate the environment variable value is from Vault.
• Deploy and test the application.
• Work with the AWS service owner to revoke the previous secret value.