AWS automatic secret rotation

1. Navigate to the Add an Identity provider section in the AWS IAM service.

2. Select the OpenID connect provider type.

3. Use https://idp.hashicorp.com/oidc/organization/<org-id> as the provider URL, replacing the placeholder with your HCP organization ID.

4. Use arn:aws:iam::<account-id>:oidc-provider/idp.hashicorp.com/oidc/organization/<org-id> as the audience, replacing the placeholders with your AWS account ID and HCP organization ID.

   Note

   You can navigate to the AWS integration creation page on the HCP portal and select AWS STS credentials from the list to easily find the appropriate Provider URL and org ID.

5. Click Add provider.

6. Select the identity provider you just created and note its ARN and Audience for the next steps.

This step is not needed for setting up auth with access keys.

The Terraform AWS provider can be used to provision the necessary resources.

1. Follow the Terraform documentation to authenticate the AWS provider.

2. Use your preferred text editor and create a Terraform configuration file with the following snippet:

   provider "aws" {}
   
   variable "organization_id" {
     type        = string
     description = "Your HCP organization ID."
   }
   
   variable "project_id" {
     type        = string
     description = "Your HCP project ID."
   }
   
   variable "integration_name" {
     type        = string
     description = "Your AWS integration name. Must match the name of the AWS integration you'll eventually create in HCP Vault Secrets."
   }
   
   data "aws_caller_identity" "current" {}
   
   locals {
     account_id = data.aws_caller_identity.current.account_id
     issuer     = "idp.hashicorp.com/oidc/organization/${var.organization_id}"
     audience   = "arn:aws:iam::${local.account_id}:oidc-provider/${local.issuer}"
     subject    = "project:${var.project_id}:geo:us:service:vault-secrets:type:integration:name:${var.integration_name}"
   }
   
   resource "aws_iam_openid_connect_provider" "hcp_vault_secrets" {
     url             = "https://${local.issuer}"
     thumbprint_list = ["9e99a48a9960b14926bb7f3b02e22da2b0ab7280"]
     client_id_list  = [local.audience]
   }
   
   data "aws_iam_policy" "iam_full_access_policy" {
     name = "IAMFullAccess"
   }
   
   resource "aws_iam_role" "integration_role" {
     name = "hcp-vault-secrets-integration"
     assume_role_policy = jsonencode({
       Version = "2012-10-17"
       Statement = [
         {
           Action = "sts:AssumeRoleWithWebIdentity"
           Effect = "Allow"
           Principal = {
             Federated = aws_iam_openid_connect_provider.hcp_vault_secrets.arn
           }
           Condition = {
             StringEquals = {
               "${local.issuer}:sub" = local.subject
             }
           }
         }
       ]
     })
   }
   
   resource "aws_iam_role_policy_attachment" "integration_role_policy_attachment" {
     role       = aws_iam_role.integration_role.name
     policy_arn = data.aws_iam_policy.iam_full_access_policy.arn
   }
   
   output "integration_name" {
     value = var.integration_name
   }
   
   output "audience" {
     value = local.audience
   }
   
   output "integration_role_arn" {
     value = aws_iam_role.integration_role.arn
   }
   
   output "dynamic_secret_role_arn" {
     value = aws_iam_role.dynamic_secret_role.arn
   }
   

3. Initialize Terraform.

   $ terraform init
   

   This will prepare a working directory:

   ...snip...
   
   Terraform has been successfully initialized!
   

4. Generate your AWS IAM configuration with the apply command:

   $ terraform apply
   

   Review the actions Terraform is about to perform and say yes to accept the plan:

   ...snip...
   
   Plan: 3 to add, 0 to change, 0 to destroy.
   
   Changes to Outputs:
   + integration_role_arn    = (known after apply)
   
   Do you want to perform these actions?
   Terraform will perform the actions described above.
   Only 'yes' will be accepted to approve.
   
   Enter a value: yes
   

5. Keep the Terraform outputs on hand for the next steps:

   Apply complete! Resources: 3 added, 0 changed, 0 destroyed.
   
   Outputs:
   
   audience = "arn:aws:iam::<account-id>:oidc-provider/idp.hashicorp.com/oidc/organization/<org-id>"
   integration_name = "<integration-name>"
   integration_role_arn = "arn:aws:iam::<account-id>:role/hcp-vault-secrets-integration"
   

Create IAM role for integration

1. Navigate to the Create Role section in the AWS IAM service.

2. Select the Web Identity trust entity type.

3. Select the Identity provider and Audience created in the previous step from the dropdown and click Next.

4. This role needs IAMFullAccess, select and click Next.

5. Give the role a name and optionally a description and tags, then click Create role.

6. Select the role you just created and note its ARN for the next steps.

   Warning

   Be cautious with the AWS access key and secret access key while they are in transit to HCP Vault Secrets. These credentials provide access to your AWS account and and do not automatically expire.

Create IAM user for integration

1. Navigate to the Create User section in the AWS IAM service.

2. Give the user a name, click Next.

3. This role needs IAMFullAccess, select and click Next.

4. Add optional tags and click Create user.

5. Select the user you just created and note its ARN for the next steps.

6. Click the Security credentials for your new user

7. Click Create access key

8. Select the Third-party service option, check the confirmation box, and click Next

9. Add optional tags and click Create access key.

10. Take note of the Access key and Secret access key for the next steps.

This step is not needed for setting up auth with access keys.