Thegcp
auth method allows Google Cloud Platform entities to authenticate to Vault. Vault treats Google Cloud as a trusted third party and verifies authenticating entities against the Google Cloud APIs. This article describes the authentication of Vault using the Google Cloud IAM service accounts
Pre-requisites:
- The vault should be installed
- Need a GCP account
- Need a project in the GCP account, if we already have then we can select the existing project & start the Cloud Shell which will load the virtual machine with all the development tools that we need.
Setup:
Note:- Run all these commands in the Cloud Shell
1) Make sure the Google Cloud IAM API is enabled.
gcloud services enable iam.googleapis.com
2) We will create two service accounts. One is for Vault so that it can communicate with GCP as by default it has no such permission. We can create a service account with the name "vaultgcpadmin" service account. The Vault will use this account for verification calls to GCP.
Create the vaultgcpadmin service account and a JSON key file:
gcloud iam service-accounts create vaultgcpadmin
export VAULTGCPADMIN_SA_EMAIL="vaultgcpadmin@${GOOGLE_CLOUD_PROJECT}.iam.gserviceaccount.com"
gcloud iam service-accounts keys create vaultgcpadmin-key.json \ --iam-account=${VAULTGCPADMIN_SA_EMAIL}
Next, grant this account the appropriate permissions so that Vault can verify service accounts:
gcloud iam roles create vaultGcpAdmin \
--permissions="iam.serviceAccounts.get,iam.serviceAccountKeys.get" \
--project=${GOOGLE_CLOUD_PROJECT}
Assigning the service account vaultgcpadmin to role vaultGcpAdmin
gcloud projects add-iam-policy-binding ${GOOGLE_CLOUD_PROJECT} \
--member="serviceAccount:${VAULTGCPADMIN_SA_EMAIL}" \
--role="projects/${GOOGLE_CLOUD_PROJECT}/roles/vaultGcpAdmin"
Let's create the user service account with a less privileged, acting as a user who can only get specific secrets from. Suppose a user is a bob.
gcloud iam service-accounts create bob
export BOB_SA_EMAIL="bob@${GOOGLE_CLOUD_PROJECT}.iam.gserviceaccount.com"
gcloud iam service-accounts keys create bob-key.json \
--iam-account=${BOB_SA_EMAIL}
Vault expects this account to give a signed JWT as proof of identity. As such, we need to grant this service account the ability to use the GCP IAM API method to sign Jwt on itself.
gcloud iam service-accounts add-iam-policy-binding ${BOB_SA_EMAIL} \
--member="serviceAccount:${BOB_SA_EMAIL}" \
--role="roles/iam.serviceAccountTokenCreator"
Note:- Run the below commands on the Vault server
vault secrets enable kv
vault kv put kv/test/secret key=test
#creating the policy with name test vault write sys/policy/test policy=-<<EOF path "kv/*" { capabilities = ["read", "list"] } path "kv/data/test/*" { capabilities = ["read"] } path "kv/metadata/test/*" { capabilities = ["read"] } EOF
#Enable GCP auth method
vault auth enable gcp
vault write auth/gcp/config credentials=@vaultadmin-key.json
vault write auth/gcp/role/gcp-role \
type="iam" \
project_id=${GOOGLE_CLOUD_PROJECT} \
policies="test" \
bound_service_accounts=${BOB_SA_EMAIL}
VAULT_TOKEN=PassTokenGotFromAboveCommand vault kv get kv/test/secret