mirror of
https://github.com/hashicorp/vault.git
synced 2025-12-04 00:51:11 +01:00
parent
4b0e0238ac
commit
6bbc09a18e
@ -41,7 +41,7 @@ steps are usually completed by an operator or configuration management tool.
|
|||||||
of a public and private key, so ensure you have both. Regarding roles, the Organization Owner and
|
of a public and private key, so ensure you have both. Regarding roles, the Organization Owner and
|
||||||
Project Owner roles should be sufficient for most needs, however be sure to check what each role
|
Project Owner roles should be sufficient for most needs, however be sure to check what each role
|
||||||
grants in the [MongoDB Atlas Programmatic API Key User Roles documentation](https://docs.atlas.mongodb.com/reference/user-roles/).
|
grants in the [MongoDB Atlas Programmatic API Key User Roles documentation](https://docs.atlas.mongodb.com/reference/user-roles/).
|
||||||
It is recommended to set an IP whitelist when creating the key.
|
It is recommended to set an IP Network Access list when creating the key.
|
||||||
|
|
||||||
For more detailed instructions on how to create a Programmatic API Key in the Atlas UI, including
|
For more detailed instructions on how to create a Programmatic API Key in the Atlas UI, including
|
||||||
available roles, visit the [Programmatic API Key documenation](https://docs.atlas.mongodb.com/configure-api-access/#programmatic-api-keys).
|
available roles, visit the [Programmatic API Key documenation](https://docs.atlas.mongodb.com/configure-api-access/#programmatic-api-keys).
|
||||||
@ -74,8 +74,8 @@ Programmatic API Keys:
|
|||||||
- Must be granted appropriate roles to complete required tasks
|
- Must be granted appropriate roles to complete required tasks
|
||||||
- Must belong to one organization, but may be granted access to any number of
|
- Must belong to one organization, but may be granted access to any number of
|
||||||
projects in that organization.
|
projects in that organization.
|
||||||
- May have an IP whitelist configured and some capabilities may require a
|
- May have an IP Network Access list configured and some capabilities may require a
|
||||||
whitelist to be configured (these are noted in the MongoDB Atlas API
|
Network Access list to be configured (these are noted in the MongoDB Atlas API
|
||||||
documentation).
|
documentation).
|
||||||
|
|
||||||
Create a Vault role for a MongoDB Atlas Programmatic API Key by mapping appropriate arguments to the
|
Create a Vault role for a MongoDB Atlas Programmatic API Key by mapping appropriate arguments to the
|
||||||
@ -101,10 +101,10 @@ $ vault write mongodbatlas/roles/test \
|
|||||||
roles=GROUP_DATA_ACCESS_READ_ONLY
|
roles=GROUP_DATA_ACCESS_READ_ONLY
|
||||||
```
|
```
|
||||||
|
|
||||||
## Programmatic API Key Whitelist
|
## Programmatic API Key Network Access list
|
||||||
|
|
||||||
Programmatic API Key access can and should be limited with a IP Whitelist. In the following example both a CIDR
|
Programmatic API Key access can and should be limited with a IP Network Access list. In the following example both a CIDR
|
||||||
block and IP address are added to the IP whitelist for Keys generated with this Vault role:
|
block and IP address are added to the IP Network Access list for Keys generated with this Vault role:
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
$ vault write atlas/roles/test \
|
$ vault write atlas/roles/test \
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user