Ensuring Access Control and Secrets Management with HashiCorp Boundary and Vault in HCP and AWS

Ensuring access controls and secrets management is critical in modern IT infrastructures. HashiCorp offers two powerful tools, Boundary and Vault, which seamlessly integrate into the HashiCorp Cloud Platform (HCP) and AWS. This combination enables companies to implement scalable and secure solutions. In this article, you will learn how to set up and use HashiCorp Boundary and Vault with HCP and AWS.

What is the HashiCorp Cloud Platform?

The HashiCorp Cloud Platform (HCP) provides managed services for various HashiCorp products, including Vault and Boundary. By using HCP, companies can reduce the complexity of operating these tools while leveraging the scalability and security of the cloud.

What is HashiCorp Boundary?

HashiCorp Boundary is an access management tool that enables secure access to systems and applications. It simplifies access and enhances security through fine-grained access controls, without requiring users to have direct knowledge of the underlying networks.

What is HashiCorp Vault?

HashiCorp Vault is a comprehensive tool for secrets management and protecting sensitive data. It provides a central solution for managing credentials, API keys, certificates, and other sensitive information.

Integration with AWS

AWS offers a flexible and scalable cloud infrastructure that is ideal for integrating HashiCorp Boundary and Vault. The combination with the HashiCorp Cloud Platform simplifies the management and operation of these tools significantly.

Steps to Set Up and Use

• Setting Up the HashiCorp Cloud Platform Log in to the HashiCorp Cloud Platform and create an account if you don’t already have one. Then, create a new project and select the desired services (Vault and Boundary).

• Setting Up Network Connection with AWS

  To allow HCP to access AWS resources, you need to set up a network connection between HCP and AWS. HashiCorp provides good documentation for this, which can also be implemented using Terraform.

• Setting Up HCP Vault

  Create a new Vault cluster in HCP. Choose the region and other configuration details. HCP handles the management and scaling of Vault. You will receive the endpoints and credentials needed to access Vault.

  This process can also be done via Terraform:

  Any further configuration of the cluster can be done as usual through the Vault CLI, Vault API, or Terraform.

• Setting Up HCP Boundary Create a new Boundary cluster in HCP. Select the region and other configuration details — manually or via Terraform. HCP manages the operation and scaling of Boundary. You will receive the endpoints and credentials needed to access Boundary.

  Further configuration of the cluster can be done as usual through the Boundary CLI, Boundary API or Terraform.

• Integrating HCP Vault and Boundary with AWS

  To use HCP Vault with Boundary and AWS, you need to create the appropriate access configurations. For this, you can create corresponding accounts in AWS so that Boundary can access AWS EC2 resources. To create this user, you can use the AWS Vault Secrets Engine, which provides AWS credentials for this integration.

  Then, a Host Catalog can be created in Boundary to recognize the AWS EC2 resources. In Terraform, this might look like this.

  Through this configuration, Boundary can now recognize our AWS resources, and it is possible to access them via Boundary.

  Finally, you can create a Credential Store. Depending on how you configure your AMI templates, you can also use the Vault Credential Store to access AWS instances via SSH One-Time-Passwords. This eliminates the need for additional SSH keys to access the instances.

• Using HCP Boundary with AWS

  Once the configuration is complete, you can use Boundary to access your AWS instances. You can use the Boundary CLI to establish a connection to a host:

  1boundary targets create ssh -name "aws-sample-target" -address "<aws-instance-ip>"
  2boundary connect ssh -target-id=tssh_1234567890 -username=ubuntu
  

  Without additional roles or policies, you can now access the AWS instance. This can be further restricted by working with roles and policies. Together with the boundary_host_set_plugin and its ability to dynamically filter the list of hosts in the catalog, you can provide specific hosts to individual users.

Conclusion

By combining HashiCorp Boundary and Vault with the HashiCorp Cloud Platform and AWS, companies can implement secure and efficient access and secrets management. Using HCP significantly simplifies the management and scaling of these tools, allowing you to focus on securing your infrastructure and applications.