HashiCorp Vault

Overview

Firefly can integrate with HashiCorp Vault to track secrets engines and configurations. This integration allows you to ensure your Vault setup follows infrastructure as code principles. The integration focuses on tracking Vault's configuration and setup, not the secrets themselves, aligning with infrastructure as code principles while maintaining security best practices.

Prerequisites

• HashiCorp Vault server with administrative access

• Vault server address

• A token with appropriate policies to read mounts and configurations

• Access to create and manage policies

• Ability to configure authentication methods

Setup Procedure

1. Create Required Policy

1. Log in to your HashiCorp Vault account

2. Navigate to Policies

3. Create a new policy with the following permissions:

path "*"
{
  capabilities = ["read","list"]
}

path "auth/token/renew-self"
{
  capabilities = ["update"]
}

path "auth/token/create"
{
  capabilities = ["update", "create"]
}

2. Configure Authentication

1. Navigate to Access

2. Enable a new auth method of type userpass

3. Create a new user

4. Attach the previously created policy to the user

3. Verify Integration

1. Go to the Inventory page

2. Filter by Data Source = HashiCorp Vault

3. Verify that your Vault configurations are showing up correctly

Configuration Details

• Supports monitoring of:

  • Secrets engines

  • Authentication methods

  • Mount points

  • Policy configurations

• Regular scanning of Vault configurations

• Integration with Firefly's inventory management

• Support for policy enforcement on Vault resources

• Ability to create policies for:

  • Ensuring specific secrets engines are enabled

  • Verifying authentication methods are properly configured

  • Checking for required mount points

Best Practices

1. Use read-only credentials for integration

2. Regularly verify the integration is working as expected

3. Monitor for configuration changes that might affect the integration

4. Focus on integrating tools where Firefly adds value

5. Keep track of which Vault configurations are being monitored

6. Review and update policies as needed

7. Maintain proper access controls in Vault

Troubleshooting

1. For authentication issues:

   • Verify token permissions

   • Check if the token has expired

   • Ensure the policy is correctly configured

   • Verify Vault server address is correct

2. For asset discovery issues:

   • Verify the integration is active in Firefly

   • Check if the token has access to required paths

   • Review Firefly integration logs

   • Verify Vault mount points are accessible

3. For policy enforcement issues:

   • Verify the asset types are supported

   • Check policy configuration

   • Review Firefly policy logs

   • Ensure Vault resources are properly configured

Note: This integration focuses on tracking Vault's configuration and setup, not the secrets themselves. This approach aligns with infrastructure as code principles while maintaining security best practices.