Skip to content

Commit 596f189

Browse files
kishanHashicorpkishanHashicorp
authored
RADAR-6812: Adding documentation for AWS Secrets Manager Indexing (#1155)
## Description <!-- ID for Jira ticket e.g [SPE-1234] --> :ticket: [[Jira ticket] ](https://hashicorp.atlassian.net/browse/RADAR-6812) <!-- Add a brief description of changes here. Include any other necessary relevant links --> <!-- Help your reviewer understand the type of review you need by selecting the scope and urgency. --> ### Requested review scope: - [x] Content touched by the PR _only_ (typos, clarifications, tips) - [ ] Code test (command and code block changes) - [ ] Flow and language near changes (new/rearranged steps) - [ ] Review everything (rewrites, major changes) ### Review urgency: - [x] ASAP (bug fixes, broken content, imminent releases) - [ ] 3 days (small changes, easy reviews) - [ ] 1 week (default) - [ ] Best effort (very non-urgent) <!-- Fill out only the appropriate checklist for your type of feature (or both if necessary) and delete the other one! --> ## All updates: <!-- This section is mandatory for all PRs: --> I have: - [ ] Verified that all status checks have passed - [ ] Verified that preview environment has successfully deployed - [x] Verified appropriate `label` applied (`hcp` + `product name`) - [ ] Added all required reviewers (code owners and external) ## Content checklist (optional) Please do these things before requesting a review. I have: - [ ] Made any associated code repositories public - [ ] Added the `hashicorp-education/teamName` to any additional code or example repos as repo admin - [ ] Added redirects for any moved or removed pages - [ ] Spell checked the tutorial(s) - [ ] Followed the [unified style guide](https://github.com/hashicorp/web-unified-docs/tree/main/docs/style-guide) - [ ] Linted code snippets (Details per language [here](https://github.com/hashicorp/engineering-docs/blob/master/writing/markdown.md#code-blocks)) - [ ] Checked the steps for completeness (no steps are implied or hidden) - [ ] Looked at the local or vercel build and checked each new or changed page for: - display on the product curriculum page - callout box formatting - code block highlighting - right-hand navigation - next and back buttons - URL path [SPE-1234]: https://hashicorp.atlassian.net/browse/SPE-1234?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
2 parents ba6d850 + e13dd45 commit 596f189

File tree

5 files changed

+137
-2
lines changed

5 files changed

+137
-2
lines changed

‎content/hcp-docs/content/docs/vault-radar/agent/correlate-aws-secrets-manager.mdx‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
---
2+
page_title: Correlate findings with AWS Secrets Manager
3+
description: >-
4+
Correlate findings from HCP Vault Radar with secrets stored in AWS Secrets Manager.
5+
---
6+
7+
# Correlate findings with AWS Secrets Manager
8+
9+
When HCP Vault Radar connects to AWS Secrets Manager, Vault Radar can correlate
10+
findings with secrets stored in AWS Secrets Manager. This allows you to identify
11+
what secrets you need to rotate.
12+
13+
## Connect AWS Secrets Manager
14+
15+
Before you can correlate findings with AWS Secrets Manager, you need to [deploy
16+
the Radar agent](/hcp/docs/vault-radar/agent/deploy). Once you deploy the agent,
17+
you can configure and connect AWS Secrets Manager to the agent.
18+
19+
## Prerequisites
20+
21+
You need one of the following AWS authentication methods:
22+
23+
- IAM role authentication with an EC2 instance or configured IAM role
24+
- Environment variables authentication with AWS Access Key ID and Secret Access Key
25+
26+
Both authentication methods support an optional assume role ARN for
27+
cross-account access or elevated permissions. For more information about
28+
assuming roles, refer to the [AWS STS AssumeRole
29+
documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html).
30+
31+
### Required permissions
32+
33+
The IAM user, role, or assumed role must have the following permissions:
34+
35+
| Service | Permission | Documentation |
36+
|---------|------------|---------------|
37+
| Secrets Manager | `secretsmanager:ListSecrets` | [ListSecrets API](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecrets.html) |
38+
| Secrets Manager | `secretsmanager:DescribeSecret` | [DescribeSecret API](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DescribeSecret.html) |
39+
| Secrets Manager | `secretsmanager:GetSecretValue` | [GetSecretValue API](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html) |
40+
| Secrets Manager | `secretsmanager:ListSecretVersionIds` | [ListSecretVersionIds API](https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_ListSecretVersionIds.html) |
41+
| EC2 | `ec2:DescribeRegions` | [DescribeRegions API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRegions.html) |
42+
| STS | `sts:GetCallerIdentity` | [GetCallerIdentity API](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html) |
43+
44+
**Example AWS IAM policy:**
45+
46+
```json
47+
{
48+
"Version": "2012-10-17",
49+
"Statement": [
50+
{
51+
"Effect": "Allow",
52+
"Action": [
53+
"secretsmanager:ListSecrets",
54+
"secretsmanager:DescribeSecret",
55+
"secretsmanager:GetSecretValue",
56+
"secretsmanager:ListSecretVersionIds"
57+
],
58+
"Resource": "*"
59+
},
60+
{
61+
"Effect": "Allow",
62+
"Action": [
63+
"ec2:DescribeRegions"
64+
],
65+
"Resource": "*"
66+
},
67+
{
68+
"Effect": "Allow",
69+
"Action": [
70+
"sts:GetCallerIdentity"
71+
],
72+
"Resource": "*"
73+
}
74+
]
75+
}
76+
```
77+
78+
## Agent configuration with AWS Secrets Manager
79+
80+
Set up and manage AWS Secrets Manager from the Vault Radar module in the [HCP
81+
Portal](https://portal.cloud.hashicorp.com/).
82+
83+
1. Click **Settings**.
84+
85+
1. Click **Secret Managers**.
86+
87+
1. Click **Connect new secret manager**.
88+
89+
1. Select **AWS Secrets Manager** and click **Next**.
90+
91+
1. Select an AWS authentication method from the **Authentication method** pulldown menu.
92+
93+
1. Enter the details for the selected method and click **Next** to validate the connection.
94+
95+
<Tabs>
96+
<Tab heading="IAM Role">
97+
98+
- Select **IAM Role** if you want to use instance profile or role-based authentication.
99+
100+
![IAM Role](/img/docs/vault-radar/indexing/aws-secrets-manager/iam-role.png)
101+
102+
- (Optional) Enter an assume role ARN in the **Assume Role ARN** text field if you need to assume a different role for access.
103+
104+
</Tab>
105+
<Tab heading="Environment Variables">
106+
107+
- Select **AWS Credentials from environment variables** if you want to use access keys.
108+
109+
![Environment Variables](/img/docs/vault-radar/indexing/aws-secrets-manager/environment-variables.png)
110+
111+
- Enter your AWS Access Key ID location in the **AWS Access Key ID Env variable** text field (default: `env://AWS_ACCESS_ID_LOCATION`).
112+
113+
- Enter your AWS Secret Access Key location in the **AWS Secret Access Key Env variable** text field (default: `env://AWS_SECRET_KEY_LOCATION`).
114+
115+
- (Optional) Enter an assume role ARN in the **Assume Role ARN** text field if you need to assume a different role for access.
116+
117+
</Tab>
118+
</Tabs>
119+
120+
Vault Radar fetches all active regions for the account and automatically starts index scan for each region.

‎content/hcp-docs/content/docs/vault-radar/agent/correlate-vault.mdx‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,26 @@ Vault Dedicated or Vault Enterprise clusters.
1313

1414
</Highlight>
1515

16-
When the HCP Vault Radar agent connects to a HCP Vault Dedicated or Vault Enterprise cluster,
16+
When the Vault Radar agent connects to a Vault Dedicated or Vault Enterprise cluster,
1717
Vault Radar can correlate findings with secrets stored in Vault. This allows you to identify
1818
what secrets you need to rotate.
1919

2020
## Connect a Vault cluster
2121

2222
Before you can correlate findings with Vault, you need to [deploy the Radar
2323
agent](/hcp/docs/vault-radar/agent/deploy). Once you deploy the agent, you can
24-
configured and connect Vault to the agent.
24+
configure and connect Vault to the agent.
25+
26+
## Prerequisites
27+
28+
You need one of the following Vault authentication methods:
29+
30+
- Kubernetes
31+
- AppRole
32+
- Token
33+
34+
The authentication methods require a policy that allows the Vault Radar agent to
35+
read all KV secrets from Vault.
2536

2637
### Create a Vault policy
2738

‎content/hcp-docs/data/docs-nav-data.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -931,6 +931,10 @@
931931
{
932932
"title": "Integrate Vault Enterprise",
933933
"path": "vault-radar/agent/correlate-vault"
934+
},
935+
{
936+
"title": "Integrate AWS Secrets Manager",
937+
"path": "vault-radar/agent/correlate-aws-secrets-manager"
934938
}
935939
]
936940
},

‎content/hcp-docs/img/docs/vault-radar/indexing/aws-secrets-manager/environment-variables.png‎

187 KB
Loading

‎content/hcp-docs/img/docs/vault-radar/indexing/aws-secrets-manager/iam-role.png‎

114 KB
Loading

0 commit comments

Comments
 (0)