GCP automatic secret rotation

1. Navigate to the New workload provider and pool section in the Google Cloud IAM & Admin service.

2. Provide a name and optionally a description then click Continue.

3. Select the OpenID connect (OIDC) provider type.

4. Provide a descriptive name such as hcp-rotating-secrets-<project-name>.

5. Use https://idp.hashicorp.com/oidc/organization/<org-id> as the issuer URL, replacing the placeholder with your HCP organization ID.

   Note

   You can navigate to the GCP integration creation page on the HCP portal and select GCP service account credentials from the list to easily find the appropriate Issuer URL.

6. Note the default audience for the next steps then click Continue.

7. Enter assertion.sub in the OIDC 1 input field to map the provider attributes then click Save.

1. Follow the Terraform documentation to authenticate the Google provider.

2. Use your preferred text editor and create a Terraform configuration file with the following snippet:

   provider "google" {
     project = var.gcp_project_id
   }
   
   variable "gcp_project_id" {
     type        = string
     description = "Your GCP project ID"
   }
   variable "organization_id" {
     type        = string
     description = "Your HCP organization ID"
   }
   variable "project_id" {
     type        = string
     description = "Your HCP project ID"
   }
   variable "integration_name" {
     type        = string
     description = "Your GCP integration name. Must match the name of the GCP integration you'll eventually create in HCP Vault Secrets."
   }
   
   data "google_project" "gcp_project" {}
   
   locals {
     pool_id            = "hcp-vault-secrets"
     pool_provider_id   = "hcp-vault-secrets"
     gcp_project_number = data.google_project.gcp_project.number
     audience           = "https://iam.googleapis.com/projects/${local.gcp_project_number}/locations/global/workloadIdentityPools/${local.pool_id}/providers/${local.pool_provider_id}"
     subject            = "project:${var.project_id}:geo:us:service:vault-secrets:type:integration:name:${var.integration_name}"
   }
   
   resource "google_iam_workload_identity_pool" "hcp_vault_secrets" {
     workload_identity_pool_id = local.pool_id
   }
   resource "google_iam_workload_identity_pool_provider" "hcp_vault_secrets" {
     workload_identity_pool_id          = google_iam_workload_identity_pool.hcp_vault_secrets.workload_identity_pool_id
     workload_identity_pool_provider_id = local.pool_provider_id
     display_name                       = "HCP Vault Secrets"
     description                        = "OIDC identity pool provider for HCP Vault Secrets"
     attribute_mapping = {
       "google.subject" = "assertion.sub"
     }
     oidc {
       allowed_audiences = [local.audience]
       issuer_uri        = "https://idp.hashicorp.com/oidc/organization/${var.organization_id}"
     }
   }
   
   resource "google_service_account" "integration_service_account" {
     account_id   = "integration-service-account"
     display_name = "Integration service account"
   }
   resource "google_service_account_iam_member" "integration_binding" {
     service_account_id = google_service_account.integration_service_account.id
     role               = "roles/iam.workloadIdentityUser"
     member             = "principal://iam.googleapis.com/projects/${local.gcp_project_number}/locations/global/workloadIdentityPools/${google_iam_workload_identity_pool.hcp_vault_secrets.workload_identity_pool_id}/subject/${local.subject}"
   }
   resource "google_project_iam_member" "integration_binding" {
     project = var.gcp_project_id
     role    = "roles/iam.serviceAccountKeyAdmin"
     member  = "serviceAccount:${google_service_account.integration_service_account.email}"
   }
   
   resource "google_service_account" "rotating_secret_service_account" {
     account_id   = "secret-service-account"
     display_name = "Rotating secret service account"
   }
   resource "google_project_iam_member" "secret_binding" {
     project = var.gcp_project_id
     role    = "roles/iam.serviceAccountViewer"
     member  = "serviceAccount:${google_service_account.rotating_secret_service_account.email}"
   }
   
   output "integration_name" {
     value = var.integration_name
   }
   
   output "audience" {
     value = local.audience
   }
   
   output "integration_service_account_email" {
     value = google_service_account.integration_service_account.email
   }
   
   output "rotating_secret_service_account_email" {
     value = google_service_account.rotating_secret_service_account.email
   }
   

3. Initialize Terraform.

   $ terraform init
   

   This will prepare a working directory:

   ...snip...
   
   Terraform has been successfully initialized!
   

4. Run terraform apply -auto-approve to create the Google Cloud configuration.

   $ terraform apply
   

5. Review the actions Terraform is about to perform and type yes to accept the plan.

   ...snip...
   
   Plan: 7 to add, 0 to change, 0 to destroy.
   
   Changes to Outputs:
   + audience                             = "https://iam.googleapis.com/projects/<proj-id>/locations/global/workloadIdentityPools/hcp-vault-secrets/providers/hcp-vault-secrets"
   + rotating_secret_service_account_email = (known after apply)
   + integration_name                     = "<integration-name>"
   + integration_service_account_email    = (known after apply)
   
   Do you want to perform these actions?
   Terraform will perform the actions described above.
   Only 'yes' will be accepted to approve.
   
   Enter a value: yes
   

6. Keep the Terraform outputs on hand for the next steps:

   Apply complete! Resources: 7 added, 0 changed, 0 destroyed.
   
   Outputs:
   
   audience = "https://iam.googleapis.com/projects/<proj-id>/locations/global/workloadIdentityPools/hcp-vault-secrets/providers/hcp-vault-secrets"
   rotating_secret_service_account_email = "secret-service-account@hvs-test-<id>.iam.gserviceaccount.com"
   integration_name = "<integration-name>"
   integration_service_account_email = "integration-service-account@hvs-test-<id>.iam.gserviceaccount.com"
   

1. Click + Grant Access by the top navigation bar.

2. Select Grant access using Service Account Impersonation.

3. Click the drop-down menu for Select service account, then New Service Account.

4. Provide a descriptive name such as hvs-rotating-secrets-integration and optionally a description, then click Create and Continue.

5. Select the Service Account Key Admin role, then click Continue.

6. Do not grant users access to this service account, simply click Done.

7. Navigate back to the Grant Access panel and select the service account we just created.

8. Use project:<project-id>:geo:us:service:vault-secrets:type:integration:name:<integration-name> as the attribute value, replacing the placeholders with your HCP project ID and HCP integration name.

   Note

   You can navigate to the GCP integration creation page on the HCP portal and select GCP service account credentials from the list to easily find the appropriate Service Account subject.

9. Dismiss the Configure your application modal.

10. Click to Service Accounts in the left navigation bar, and note the email for the service account you just created for the next steps.

1. Navigate to the Create Service Account section in the Google Cloud IAM Admin service.

2. Give the service account a name and optionally a description, click Create and Continue

3. Select the Service Account Key Admin role, click Continue

4. Do not grant users access to this service account, click Done

5. Select the service account you just created from the Service Accounts table

6. From the Keys tab, click Add Key, then Create new key

7. Select the JSON key type, click Create

8. A JSON file will be downloaded by your browser. You'll need this later when configuring the integration.

The GCP service account was created in the Terraform configuration file from the previous step, continue to the next step.

1. Navigate to the Create Service Account section in the Google Cloud IAM & Admin service.

2. Give the service account a name and optionally a description, then click Create and Continue.

3. Click on Service Accounts in the left navigation bar, and note the service account email you just created for the next steps.

1. Navigate to the Create Service Account section in the Google Cloud IAM & Admin service.

2. Give the service account a name and optionally a description, then click Create and Continue.

3. Click on Service Accounts in the left navigation bar, and note the service account email you just created for the next steps.

The GCP service account was created in the Terraform configuration file from a previous step, continue to the next step.

1. Provide a unique Integration Name for this integration.

2. Use the integration service account email configured during the previous steps.

3. Use the GCP workload identity provider audience configured during the previous steps. The format is https://iam.googleapis.com/projects/<project>/locations/global/workloadIdentityPools/<pool-name>/providers/<provider-name>.

4. Click Add new integration to return to the new secret form.

   Note

   If you encounter an error, make sure the service account subject and audience matches between HCP and GCP.

1. Provide a unique Integration Name for this integration.

2. Upload or copy/paste the Service Account Key JSON file you downloaded from GCP during the previous steps.

3. Click Add new integration to return to the new secret form.

1. Provide a unique Integration Name for this integration.

2. Use the integration service account email configured during the previous steps.

3. Use the GCP workload identity provider audience configured during the previous steps. The format is https://iam.googleapis.com/projects/<project>/locations/global/workloadIdentityPools/<pool-name>/providers/<provider-name>.

4. Click Add new integration to return to the new secret form.

   Note

   If you encounter an error, make sure the service account subject and audience matches between HCP and GCP.