Skip to content

Commit 17a99d2

Browse files
miagilepnerschavis
miagilepner
and
schavis
authored
VAULT-36949: Automated snapshot cloud permissions (#1145)
* list cloud permissions required for automated snapshots * Apply suggestions from code review Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com> * fix typos --------- Co-authored-by: Sarah Chavis <62406755+schavis@users.noreply.github.com>
1 parent e6cbb9b commit 17a99d2

File tree

4 files changed

+164
-77
lines changed

4 files changed

+164
-77
lines changed

‎content/vault/v1.16.x/content/api-docs/system/storage/raftautosnapshots.mdx‎

Lines changed: 37 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,12 @@ environment variables or files on disk in predefined locations.
7171

7272
- `aws_s3_region` `(string: <required>)` - AWS region bucket is in.
7373

74-
- `aws_access_key_id` `(string)` - AWS access key ID.
74+
- `aws_access_key_id` `(string)` - AWS access key ID. The associated AWS account
75+
must have the following permissions in S3 so that Vault can store and manage
76+
the snapshots:
77+
- `s3:ListBucket`
78+
- `s3:PutObject`
79+
- `s3:DeleteObject`
7580

7681
- `aws_secret_access_key` `(string)` - AWS secret access key.
7782

@@ -87,7 +92,11 @@ environment variables or files on disk in predefined locations.
8792
- `aws_s3_force_path_style` `(boolean)` - Use the endpoint/bucket URL style
8893
instead of bucket.endpoint. May be needed when setting `aws_s3_endpoint`.
8994

90-
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents.
95+
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents. To use
96+
KMS encryption, the associated AWS account must have the following
97+
permissions:
98+
- `kms:Decrypt`
99+
- `kms:GenerateDataKey`
91100

92101
- `aws_s3_server_side_encryption` `(boolean)` - Use AES256 to encrypt bucket contents. Cannot use with `aws_s3_enable_kms` parameter.
93102

@@ -98,23 +107,27 @@ environment variables or files on disk in predefined locations.
98107
- `google_gcs_bucket` `(string: <required>)` GCS bucket to write snapshots to.
99108

100109
- `google_service_account_key` `(string)` - Google service account key in JSON format. Depending
101-
on how the API is invoked, this may be need to be JSON-escaped, e.g. for newlines and double quotes.
110+
on how the API is invoked, this may need to be JSON-escaped, e.g. for newlines and double quotes.
102111
The raw value looks like this:
103-
104-
```json
105-
{
106-
"type": "service_account",
107-
"project_id": "project-id",
108-
"private_key_id": "key-id",
109-
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
110-
"client_email": "service-account-email",
111-
"client_id": "client-id",
112-
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
113-
"token_uri": "https://accounts.google.com/o/oauth2/token",
114-
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
115-
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
116-
}
117-
```
112+
```json
113+
{
114+
"type": "service_account",
115+
"project_id": "project-id",
116+
"private_key_id": "key-id",
117+
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
118+
"client_email": "service-account-email",
119+
"client_id": "client-id",
120+
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
121+
"token_uri": "https://accounts.google.com/o/oauth2/token",
122+
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
123+
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
124+
}
125+
```
126+
127+
The associated Google service account must have the following permissions in Google Cloud Storage so that Vault can store and manage the snapshots:
128+
- `storage.objects.create`
129+
- `storage.objects.list`
130+
- `storage.objects.delete`
118131

119132
- `google_endpoint` `(string)` - GCS endpoint. This is typically only set when
120133
using a non-Google GCS implementation like fake-gcs-server.
@@ -128,7 +141,12 @@ environment variables or files on disk in predefined locations.
128141
- `azure_container_name` `(string: <required>)` - Azure container name to write
129142
snapshots to.
130143

131-
- `azure_account_name` `(string)` - Azure account name.
144+
- `azure_account_name` `(string)` - Azure account name. The associated Azure
145+
account must have the following permissions in Azure Blob Storage so that
146+
Vault can store and manage the snapshots:
147+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`
148+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`
149+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete`
132150

133151
- `azure_account_key` `(string)` - Azure account key.
134152

‎content/vault/v1.19.x/content/api-docs/system/storage/raftautosnapshots.mdx‎

Lines changed: 37 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,12 @@ parameters in the context of AWS EKS & S3 configuration.
8181

8282
- `aws_s3_region` `(string: <required>)` - AWS region bucket is in.
8383

84-
- `aws_access_key_id` `(string)` - AWS access key ID.
84+
- `aws_access_key_id` `(string)` - AWS access key ID. The associated AWS account
85+
must have the following permissions in S3 so that Vault can store and manage
86+
the snapshots:
87+
- `s3:ListBucket`
88+
- `s3:PutObject`
89+
- `s3:DeleteObject`
8590

8691
- `aws_secret_access_key` `(string)` - AWS secret access key.
8792

@@ -97,7 +102,10 @@ parameters in the context of AWS EKS & S3 configuration.
97102
- `aws_s3_force_path_style` `(boolean)` - Use the endpoint/bucket URL style
98103
instead of bucket.endpoint. May be needed when setting `aws_s3_endpoint`.
99104

100-
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents.
105+
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents. To use
106+
KMS encryption, the associated account must have the following permissions:
107+
- `kms:Decrypt`
108+
- `kms:GenerateDataKey`
101109

102110
- `aws_s3_server_side_encryption` `(boolean)` - Use AES256 to encrypt bucket contents. Cannot use with `aws_s3_enable_kms` parameter.
103111

@@ -108,23 +116,28 @@ parameters in the context of AWS EKS & S3 configuration.
108116
- `google_gcs_bucket` `(string: <required>)` GCS bucket to write snapshots to.
109117

110118
- `google_service_account_key` `(string)` - Google service account key in JSON format. Depending
111-
on how the API is invoked, this may be need to be JSON-escaped, e.g. for newlines and double quotes.
112-
The raw value looks like this:
119+
on how you invoke the API, you may need to JSON-escape the account key. For
120+
example, to include data with newlines and double quotes the raw value would
121+
look like:
122+
```json
123+
{
124+
"type": "service_account",
125+
"project_id": "project-id",
126+
"private_key_id": "key-id",
127+
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
128+
"client_email": "service-account-email",
129+
"client_id": "client-id",
130+
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
131+
"token_uri": "https://accounts.google.com/o/oauth2/token",
132+
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
133+
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
134+
}
135+
```
113136

114-
```json
115-
{
116-
"type": "service_account",
117-
"project_id": "project-id",
118-
"private_key_id": "key-id",
119-
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
120-
"client_email": "service-account-email",
121-
"client_id": "client-id",
122-
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
123-
"token_uri": "https://accounts.google.com/o/oauth2/token",
124-
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
125-
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
126-
}
127-
```
137+
The associated Google service account must have the following permissions in Google Cloud Storage so that Vault can store and manage the snapshots:
138+
- `storage.objects.create`
139+
- `storage.objects.list`
140+
- `storage.objects.delete`
128141

129142
- `google_endpoint` `(string)` - GCS endpoint. This is typically only set when
130143
using a non-Google GCS implementation like fake-gcs-server.
@@ -138,7 +151,12 @@ parameters in the context of AWS EKS & S3 configuration.
138151
- `azure_container_name` `(string: <required>)` - Azure container name to write
139152
snapshots to.
140153

141-
- `azure_account_name` `(string)` - Azure account name.
154+
- `azure_account_name` `(string)` - Azure account name. The associated Azure
155+
account must have the following permissions in Azure Blob Storage so that
156+
Vault can store and manage the snapshots:
157+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`
158+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`
159+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete`
142160

143161
- `azure_auth_mode` `(string)` - One of `shared`, `managed`, or `environment`. If `environment` is set, Azure authentication details are retrieved from the environment variables: `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_TENANT_ID`, `AZURE_SUBSCRIPTION_ID`.
144162

‎content/vault/v1.20.x/content/api-docs/system/storage/raftautosnapshots.mdx‎

Lines changed: 44 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,15 @@ parameters in the context of AWS EKS & S3 configuration.
8181

8282
- `aws_s3_region` `(string: <required>)` - AWS region bucket is in.
8383

84-
- `aws_access_key_id` `(string)` - AWS access key ID.
84+
- `aws_access_key_id` `(string)` - AWS access key ID. The associated AWS account
85+
must have the following permissions in S3 so that Vault can store and manage
86+
the snapshots:
87+
- `s3:ListBucket`
88+
- `s3:PutObject`
89+
- `s3:DeleteObject`
90+
91+
To load a snapshot with your configuration, the account also needs:
92+
- `s3:GetObject`
8593

8694
- `aws_secret_access_key` `(string)` - AWS secret access key.
8795

@@ -97,7 +105,10 @@ parameters in the context of AWS EKS & S3 configuration.
97105
- `aws_s3_force_path_style` `(boolean)` - Use the endpoint/bucket URL style
98106
instead of bucket.endpoint. May be needed when setting `aws_s3_endpoint`.
99107

100-
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents.
108+
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents. To use
109+
KMS encryption, the associated AWS account must have the following permissions:
110+
- `kms:Decrypt`
111+
- `kms:GenerateDataKey`
101112

102113
- `aws_s3_server_side_encryption` `(boolean)` - Use AES256 to encrypt bucket contents. Cannot use with `aws_s3_enable_kms` parameter.
103114

@@ -108,23 +119,32 @@ parameters in the context of AWS EKS & S3 configuration.
108119
- `google_gcs_bucket` `(string: <required>)` GCS bucket to write snapshots to.
109120

110121
- `google_service_account_key` `(string)` - Google service account key in JSON format. Depending
111-
on how the API is invoked, this may be need to be JSON-escaped, e.g. for newlines and double quotes.
112-
The raw value looks like this:
122+
on how you invoke the API, you may need to JSON-escape the account key. For
123+
example, to include data with newlines and double quotes the raw value would
124+
look like:
125+
```json
126+
{
127+
"type": "service_account",
128+
"project_id": "project-id",
129+
"private_key_id": "key-id",
130+
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
131+
"client_email": "service-account-email",
132+
"client_id": "client-id",
133+
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
134+
"token_uri": "https://accounts.google.com/o/oauth2/token",
135+
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
136+
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
137+
}
138+
```
113139

114-
```json
115-
{
116-
"type": "service_account",
117-
"project_id": "project-id",
118-
"private_key_id": "key-id",
119-
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
120-
"client_email": "service-account-email",
121-
"client_id": "client-id",
122-
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
123-
"token_uri": "https://accounts.google.com/o/oauth2/token",
124-
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
125-
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
126-
}
127-
```
140+
The associated Google service account must have following permissions in
141+
Google Cloud Storage so that Vault can store and manage the snapshots:
142+
- `storage.objects.create`
143+
- `storage.objects.list`
144+
- `storage.objects.delete`
145+
146+
To load a snapshot with your configuration, the account also needs:
147+
- `storage.objects.get`
128148

129149
- `google_endpoint` `(string)` - GCS endpoint. This is typically only set when
130150
using a non-Google GCS implementation like fake-gcs-server.
@@ -138,7 +158,12 @@ parameters in the context of AWS EKS & S3 configuration.
138158
- `azure_container_name` `(string: <required>)` - Azure container name to write
139159
snapshots to.
140160

141-
- `azure_account_name` `(string)` - Azure account name.
161+
- `azure_account_name` `(string)` - Azure account name. The associated Azure
162+
account must have the following permissions in Azure Blob Storage so that
163+
Vault can store and manage the snapshots:
164+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`
165+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`
166+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete`
142167

143168
- `azure_auth_mode` `(string)` - One of `shared`, `managed`, or `environment`. If `environment` is set, Azure authentication details are retrieved from the environment variables: `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_TENANT_ID`, `AZURE_SUBSCRIPTION_ID`.
144169

‎content/vault/v1.21.x (rc)/content/api-docs/system/storage/raftautosnapshots.mdx‎

Lines changed: 46 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,16 @@ parameters in the context of AWS EKS & S3 configuration.
9595

9696
- `aws_s3_region` `(string: <required>)` - AWS region bucket is in.
9797

98-
- `aws_access_key_id` `(string)` - AWS access key ID.
98+
- `aws_access_key_id` `(string)` - AWS access key ID. The associated AWS account
99+
must have the following permissions in S3 so that Vault can store and manage
100+
the snapshots:
101+
- `s3:ListBucket`
102+
- `s3:PutObject`
103+
- `s3:DeleteObject`
104+
105+
If you want to use the configuration to enable snapshot autoloading or to
106+
manually load a snapshot, the account also needs:
107+
- `s3:GetObject`
99108

100109
- `aws_secret_access_key` `(string)` - AWS secret access key.
101110

@@ -111,7 +120,10 @@ parameters in the context of AWS EKS & S3 configuration.
111120
- `aws_s3_force_path_style` `(boolean)` - Use the endpoint/bucket URL style
112121
instead of bucket.endpoint. May be needed when setting `aws_s3_endpoint`.
113122

114-
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents.
123+
- `aws_s3_enable_kms` `(boolean)` - Use KMS to encrypt bucket contents. To use
124+
KMS encryption, the associated AWS account must have the following permissions:
125+
- `kms:Decrypt`
126+
- `kms:GenerateDataKey`
115127

116128
- `aws_s3_server_side_encryption` `(boolean)` - Use AES256 to encrypt bucket contents. Cannot use with `aws_s3_enable_kms` parameter.
117129

@@ -122,23 +134,32 @@ parameters in the context of AWS EKS & S3 configuration.
122134
- `google_gcs_bucket` `(string: <required>)` GCS bucket to write snapshots to.
123135

124136
- `google_service_account_key` `(string)` - Google service account key in JSON format. Depending
125-
on how the API is invoked, this may be need to be JSON-escaped, e.g. for newlines and double quotes.
137+
on how the API is invoked, this may need to be JSON-escaped, e.g. for newlines and double quotes.
126138
The raw value looks like this:
127-
128-
```json
129-
{
130-
"type": "service_account",
131-
"project_id": "project-id",
132-
"private_key_id": "key-id",
133-
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
134-
"client_email": "service-account-email",
135-
"client_id": "client-id",
136-
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
137-
"token_uri": "https://accounts.google.com/o/oauth2/token",
138-
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
139-
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
140-
}
141-
```
139+
```json
140+
{
141+
"type": "service_account",
142+
"project_id": "project-id",
143+
"private_key_id": "key-id",
144+
"private_key": "-----BEGIN RSA PRIVATE KEY-----\nMIIEpQ ... /WZs=\n-----END RSA PRIVATE KEY-----\n",
145+
"client_email": "service-account-email",
146+
"client_id": "client-id",
147+
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
148+
"token_uri": "https://accounts.google.com/o/oauth2/token",
149+
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
150+
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/service-account-email"
151+
}
152+
```
153+
154+
The associated Google service account must have following permissions in
155+
Google Cloud Storage so that Vault can store and manage the snapshots:
156+
- `storage.objects.create`
157+
- `storage.objects.list`
158+
- `storage.objects.delete`
159+
160+
If you want to use the configuration to enable snapshot autoloading or to
161+
manually load a snapshot, the account also needs:
162+
- `storage.objects.get`
142163

143164
- `google_endpoint` `(string)` - GCS endpoint. This is typically only set when
144165
using a non-Google GCS implementation like fake-gcs-server.
@@ -148,11 +169,16 @@ parameters in the context of AWS EKS & S3 configuration.
148169
`google_endpoint`.
149170

150171
#### storage_type=azure-blob
151-
172+
152173
- `azure_container_name` `(string: <required>)` - Azure container name to write
153174
snapshots to.
154175

155-
- `azure_account_name` `(string)` - Azure account name.
176+
- `azure_account_name` `(string)` - Azure account name. The associated Azure
177+
account must have the following permissions in Azure Blob Storage so that
178+
Vault can store and manage the snapshots:
179+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read`
180+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write`
181+
- `Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete`
156182

157183
- `azure_auth_mode` `(string)` - One of `shared`, `managed`, or `environment`.
158184
If `environment` is set, Azure authentication details are retrieved from the

0 commit comments

Comments
 (0)