Skip to content

Commit 832a234

Browse files
Update correlate secrets docs
1 parent a060024 commit 832a234

File tree

2 files changed

+58
-33
lines changed

2 files changed

+58
-33
lines changed

content/hcp-docs/content/docs/vault-radar/agent/correlate-aws-secrets-manager.mdx

Lines changed: 45 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,27 @@ description: >-
66

77
# Correlate findings with AWS Secrets Manager
88

9-
When HCP Vault Radar connects to AWS Secrets Manager, Vault Radar can correlate findings with secrets stored in AWS Secrets Manager. This allows you to identify what secrets you need to rotate.
9+
When HCP Vault Radar connects to AWS Secrets Manager, Vault Radar can correlate
10+
findings with secrets stored in AWS Secrets Manager. This allows you to identify
11+
what secrets you need to rotate.
1012

1113
## Connect AWS Secrets Manager
1214

13-
Before you can correlate findings with AWS Secrets Manager, you need to [deploy the Radar agent](/hcp/docs/vault-radar/agent/deploy). Once you deploy the agent, you can configure and connect AWS Secrets Manager to the agent.
15+
Before you can correlate findings with AWS Secrets Manager, you need to [deploy
16+
the Radar agent](/hcp/docs/vault-radar/agent/deploy). Once you deploy the agent,
17+
you can configure and connect AWS Secrets Manager to the agent.
1418

1519
## Prerequisites
1620

17-
You need one of the following authentication methods:
21+
You need one of the following AWS authentication methods:
1822

1923
- IAM role authentication with an EC2 instance or configured IAM role
2024
- Environment variables authentication with AWS Access Key ID and Secret Access Key
2125

22-
Both authentication methods support an optional assume role ARN for cross-account access or elevated permissions. For more information about assuming roles, refer to the [AWS STS AssumeRole documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html).
26+
Both authentication methods support an optional assume role ARN for
27+
cross-account access or elevated permissions. For more information about
28+
assuming roles, refer to the [AWS STS AssumeRole
29+
documentation](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html).
2330

2431
### Required permissions
2532

@@ -36,37 +43,44 @@ The IAM user, role, or assumed role must have the following permissions:
3643

3744
## Agent configuration with AWS Secrets Manager
3845

39-
Set up and manage AWS Secrets Manager from the Vault Radar module in the [HCP Portal](https://portal.cloud.hashicorp.com/). Select **Settings**, then **Secret Managers**, and then click **Connect new secret manager**.
46+
Set up and manage AWS Secrets Manager from the Vault Radar module in the [HCP
47+
Portal](https://portal.cloud.hashicorp.com/).
4048

41-
1. Select **AWS Secrets Manager** and click **Next**.
42-
43-
1. Select an AWS authentication method from the **Authentication method** pulldown menu.
44-
45-
1. Enter the details for the selected method and click **Next** to validate the connection.
46-
47-
<Tabs>
48-
<Tab heading="IAM Role">
49-
50-
Select **IAM Role** if you want to use instance profile or role-based authentication.
49+
1. Click **Settings**.
5150

52-
![IAM Role](/img/docs/vault-radar/indexing/aws-secrets-manager/iam-role.png)
51+
1. Click **Secret Managers**.
5352

54-
1. (Optional) Enter an assume role ARN in the **Assume Role ARN** text field if you need to assume a different role for access.
53+
1. Click **Connect new secret manager**.
5554

56-
</Tab>
57-
<Tab heading="Environment Variables">
58-
59-
Select **AWS Credentials from environment variables** if you want to use access keys.
60-
61-
![Environment Variables](/img/docs/vault-radar/indexing/aws-secrets-manager/environment-variables.png)
62-
63-
1. Enter your AWS Access Key ID location in the **AWS Access Key ID Env variable** text field (default: `env://AWS_ACCESS_ID_LOCATION`).
64-
65-
1. Enter your AWS Secret Access Key location in the **AWS Secret Access Key Env variable** text field (default: `env://AWS_SECRET_KEY_LOCATION`).
55+
1. Select **AWS Secrets Manager** and click **Next**.
6656

67-
1. (Optional) Enter an assume role ARN in the **Assume Role ARN** text field if you need to assume a different role for access.
57+
1. Select an AWS authentication method from the **Authentication method** pulldown menu.
6858

69-
</Tab>
70-
</Tabs>
59+
1. Enter the details for the selected method and click **Next** to validate the connection.
7160

72-
1. Vault Radar fetches all active regions for the account and automatically starts index scanning for each region.
61+
<Tabs>
62+
<Tab heading="IAM Role">
63+
64+
- Select **IAM Role** if you want to use instance profile or role-based authentication.
65+
66+
![IAM Role](/img/docs/vault-radar/indexing/aws-secrets-manager/iam-role.png)
67+
68+
- (Optional) Enter an assume role ARN in the **Assume Role ARN** text field if you need to assume a different role for access.
69+
70+
</Tab>
71+
<Tab heading="Environment Variables">
72+
73+
- Select **AWS Credentials from environment variables** if you want to use access keys.
74+
75+
![Environment Variables](/img/docs/vault-radar/indexing/aws-secrets-manager/environment-variables.png)
76+
77+
- Enter your AWS Access Key ID location in the **AWS Access Key ID Env variable** text field (default: `env://AWS_ACCESS_ID_LOCATION`).
78+
79+
- Enter your AWS Secret Access Key location in the **AWS Secret Access Key Env variable** text field (default: `env://AWS_SECRET_KEY_LOCATION`).
80+
81+
- (Optional) Enter an assume role ARN in the **Assume Role ARN** text field if you need to assume a different role for access.
82+
83+
</Tab>
84+
</Tabs>
85+
86+
Vault Radar fetches all active regions for the account and automatically starts index scanning for each region.

content/hcp-docs/content/docs/vault-radar/agent/correlate-vault.mdx

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,26 @@ Vault Dedicated or Vault Enterprise clusters.
1313

1414
</Highlight>
1515

16-
When the HCP Vault Radar agent connects to a HCP Vault Dedicated or Vault Enterprise cluster,
16+
When the Vault Radar agent connects to a Vault Dedicated or Vault Enterprise cluster,
1717
Vault Radar can correlate findings with secrets stored in Vault. This allows you to identify
1818
what secrets you need to rotate.
1919

2020
## Connect a Vault cluster
2121

2222
Before you can correlate findings with Vault, you need to [deploy the Radar
2323
agent](/hcp/docs/vault-radar/agent/deploy). Once you deploy the agent, you can
24-
configured and connect Vault to the agent.
24+
configure and connect Vault to the agent.
25+
26+
## Prerequisites
27+
28+
You need one of the following Vault authentication methods:
29+
30+
- Kubernetes
31+
- AppRole
32+
- Token
33+
34+
The authentication methods requires a policy to all the Vault Radar agent to
35+
read secrets from Vault.
2536

2637
### Create a Vault policy
2738

0 commit comments

Comments
 (0)