mirrors/vault
1
0
Fork 0
mirror of https://github.com/hashicorp/vault.git synced 2025-08-20 06:01:10 +02:00
Code Issues Projects Releases Wiki Activity
vault/website/source/docs/configuration/seal/gcpckms.html.md
Seth Vargo 9293594176 Reduce required permissions for the GCPCKMS auto-unsealer (#5999) 
This changes the behavior of the GCPCKMS auto-unsealer setup to attempt
encryption instead of a key lookup. Key lookups are a different API
method not covered by roles/cloudkms.cryptoKeyEncrypterDecrypter. This
means users must grant an extended scope to their service account
(granting the ability to read key data) which only seems to be used to
validate the existence of the key.

Worse, the only roles that include this permission are overly verbose
(e.g. roles/viewer which gives readonly access to everything in the
project and roles/cloudkms.admin which gives full control over all key
operations). This leaves the user stuck between choosing to create a
custom IAM role (which isn't fun) or grant overly broad permissions.

By changing to an encrypt call, we get better verification of the unseal
permissions and users can reduce scope to a single role.
2019-01-04 16:29:31 -05:00

3.7 KiB
Raw Blame History

layout, page_title, sidebar_title, sidebar_current, description
layout page_title sidebar_title sidebar_current description
docs GCP Cloud KMS - Seals - Configuration GCP Cloud KMS docs-configuration-seal-gcpckms The GCP Cloud KMS seal configures Vault to use GCP Cloud KMS as the seal wrapping mechanism.

gcpckms Seal

The GCP Cloud KMS seal configures Vault to use GCP Cloud KMS as the seal wrapping mechanism. The GCP Cloud KMS seal is activated by one of the following:

  • The presence of a seal "gcpckms" block in Vault's configuration file.
  • The presence of the environment variable VAULT_SEAL_TYPE set to gcpckms. If enabling via environment variable, all other required values specific to Cloud KMS (i.e. VAULT_GCPCKMS_SEAL_KEY_RING, etc.) must be also supplied, as well as all other GCP-related environment variables that lends to successful authentication (i.e. GOOGLE_PROJECT, etc.).

gcpckms Example

This example shows configuring GCP Cloud KMS seal through the Vault configuration file by providing all the required values:

seal "gcpckms" {
  credentials = "/usr/vault/vault-project-user-creds.json"
  project     = "vault-project"
  region      = "global"
  key_ring    = "vault-keyring"
  crypto_key  = "vault-key"
}

gcpckms Parameters

These parameters apply to the seal stanza in the Vault configuration file:

  • credentials (string: <required>): The path to the credentials JSON file to use. May be also specified by the GOOGLE_CREDENTIALS or GOOGLE_APPLICATION_CREDENTIALS environment variable or set automatically if running under Google App Engine, Google Compute Engine or Google Kubernetes Engine.

  • project (string: <required>): The GCP project ID to use. May also be specified by the GOOGLE_PROJECT environment variable.

  • region (string: "us-east-1"): The GCP region/location where the key ring lives. May also be specified by the GOOGLE_REGION environment variable.

  • key_ring (string: <required>): The GCP CKMS key ring to use. May also be specified by the VAULT_GCPCKMS_SEAL_KEY_RING environment variable.

  • crypto_key (string: <required>): The GCP CKMS crypto key to use for encryption and decryption. May also be specified by the VAULT_GCPCKMS_SEAL_CRYPTO_KEY environment variable.

Authentication & Permissions

Authentication-related values must be provided, either as environment variables or as configuration parameters.

GCP authentication values:

* `GOOGLE_CREDENTIALS` or `GOOGLE_APPLICATION_CREDENTIALS`
* `GOOGLE_PROJECT`
* `GOOGLE_REGION`

Note: The client uses the official Google SDK and will use the specified credentials, environment credentials, or application default credentials in that order, if the above GCP specific values are not provided.

The service account needs the following minimum permissions on the crypto key:

cloudkms.cryptoKeyVersions.useToEncrypt
cloudkms.cryptoKeyVersions.useToDecrypt

these permissions are available as part of the following role:

roles/cloudkms.cryptoKeyEncrypterDecrypter

gcpckms Environment Variables

Alternatively, the GCP Cloud KMS seal can be activated by providing the following environment variables:

* `VAULT_SEAL_TYPE`
* `VAULT_GCPCKMS_SEAL_KEY_RING`
* `VAULT_GCPCKMS_SEAL_CRYPTO_KEY`

Key Rotation

This seal supports rotating keys defined in Google Cloud KMS doc. Both scheduled rotation and manual rotation is supported for CKMS since the key information. Old keys version must not be disabled or deleted and are used to decrypt older data. Any new or updated data will be encrypted with the primary key version.