AWS dynamic secrets

Add identity provider

1. Navigate to the Add an Identity provider section in the AWS IAM service.

2. Select the OpenID connect provider type.

3. Use https://idp.hashicorp.com/oidc/organization/<org-id> as the provider URL, replacing the placeholder with your HCP organization ID.

   Note

   You can navigate to the AWS integration creation page on the HCP portal and select AWS STS credentials from the list to easily find the appropriate Provider URL and org ID.

4. Use arn:aws:iam::<account-id>:oidc-provider/idp.hashicorp.com/oidc/organization/<org-id> as the audience, replacing the placeholders with your AWS account ID and HCP organization ID.

5. Click Add provider.

6. Select the identity provider you just created and note its ARN and Audience for the next steps.

Create IAM role for integration

1. Navigate to the Create Role section in the AWS IAM service.

2. Select the Web Identity trust entity type.

3. Select the Identity provider and Audience created in the previous step from the dropdown and click Next.

4. This role does not need permissions, click Next.

5. Give the role a name and optionally a description and tags, then click Create role.

6. Select the role you just created and note its ARN for the next steps.

Create IAM role for dynamic secret

1. Navigate again to the Create Role section in the AWS IAM service.

2. Select the Custom trust policy trust entity type.

3. Paste the following into the trust policy editor, replacing the highlighted placeholder text with the AWS IAM role ARN created earlier, and click Next.

   {  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {      "AWS": "<iam-role-arn-from-step-2.6>"    },    "Action": "sts:AssumeRole",    "Condition": {}    }  ]}

4. Attach or create a new policy with the permissions to grant to the dynamic credentials HCP Vault Secrets will provision.

5. Give the role a name and optionally a description and tags, then click Create role.

6. Select the role you just created and note its ARN for the next steps.

Create IAM user for integration

1. Navigate to the Create User section in the AWS IAM service.

2. Give the user a name, click Next.

3. This role does not need permissions, click Next.

4. Add optional tags and click Create user.

5. Select the user you just created and note its ARN for the next steps.

6. Click the Security credentials for your new user

7. Click Create access key

8. Select the Third-party service option, check the confirmation box, and click Next

9. Add optional tags and click Create access key.

10. Take note of the Access key and Secret access key for the next steps.

Create IAM role for dynamic secret

1. Navigate again to the Create Role section in the AWS IAM service.

2. Select the Custom trust policy trust entity type.

3. Paste the following into the trust policy editor, replacing the highlighted placeholder text with the AWS IAM user ARN created earlier, and click Next.

   {  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {      "AWS": "<iam-user-arn-from-step-1.6>"    },    "Action": "sts:AssumeRole",    "Condition": {}    }  ]}

4. Attach or create a new policy with the permissions to grant to the dynamic credentials HCP Vault Secrets will provision.

5. Give the role a name and optionally a description and tags, then click Create role.

6. Select the role you just created and note its ARN for the next steps.

The Terraform AWS provider can be used to provision the necessary resources.

1. Follow the Terraform documentation to authenticate the AWS provider.

2. Use your preferred text editor and create a Terraform configuration file with the following snippet:

   provider "aws" {}variable "organization_id" {  type        = string  description = "Your HCP organization ID."}variable "project_id" {  type        = string  description = "Your HCP project ID."}variable "integration_name" {  type        = string  description = "Your AWS integration name. Must match the name of the AWS integration you'll eventually create in HCP Vault Secrets."}data "aws_caller_identity" "current" {}locals {  account_id = data.aws_caller_identity.current.account_id  issuer     = "idp.hashicorp.com/oidc/organization/${var.organization_id}"  audience   = "arn:aws:iam::${local.account_id}:oidc-provider/${local.issuer}"  subject    = "project:${var.project_id}:geo:us:service:vault-secrets:type:integration:name:${var.integration_name}"}resource "aws_iam_openid_connect_provider" "hcp_vault_secrets" {  url             = "https://${local.issuer}"  thumbprint_list = ["9e99a48a9960b14926bb7f3b02e22da2b0ab7280"]  client_id_list  = [local.audience]}resource "aws_iam_role" "integration_role" {  name = "hcp-vault-secrets-integration"  assume_role_policy = jsonencode({    Version = "2012-10-17"    Statement = [      {        Action = "sts:AssumeRoleWithWebIdentity"        Effect = "Allow"        Principal = {          Federated = aws_iam_openid_connect_provider.hcp_vault_secrets.arn        }        Condition = {          StringEquals = {            "${local.issuer}:sub" = local.subject          }        }      }    ]  })}resource "aws_iam_role" "dynamic_secret_role" {  name = "hcp-vault-secrets-dynamic-secret"  assume_role_policy = jsonencode({    "Version" : "2012-10-17",    "Statement" : [      {        "Effect" : "Allow",        "Action" : "sts:AssumeRole",        "Principal" : {          "AWS" : aws_iam_role.integration_role.arn        },        "Condition" : {}      }    ]  })  inline_policy {    name   = "hcp-vault-secrets-s3-lister"    policy = data.aws_iam_policy_document.dynamic_secret_policy.json  }}data "aws_iam_policy_document" "dynamic_secret_policy" {  # Replace with the permissions to grant to your dynamic secret  statement {    effect = "Allow"    actions = [      "s3:List*"    ]    resources = ["*"]  }}output "integration_name" {  value = var.integration_name}output "audience" {  value = local.audience}output "integration_role_arn" {  value = aws_iam_role.integration_role.arn}output "dynamic_secret_role_arn" {  value = aws_iam_role.dynamic_secret_role.arn}

3. Initialize Terraform.

   $ terraform init

   This will prepare a working directory:

   ...snip...Terraform has been successfully initialized!

4. Generate your AWS IAM configuration with the apply command:

   $ terraform apply

   Review the actions Terraform is about to perform and say yes to accept the plan:

   ...snip...Plan: 3 to add, 0 to change, 0 to destroy.Changes to Outputs:+ dynamic_secret_role_arn = (known after apply)+ integration_role_arn    = (known after apply)Do you want to perform these actions?Terraform will perform the actions described above.Only 'yes' will be accepted to approve.Enter a value: yes

5. Keep the Terraform outputs on hand for the next steps:

   Apply complete! Resources: 3 added, 0 changed, 0 destroyed.Outputs:audience = "arn:aws:iam::<account-id>:oidc-provider/idp.hashicorp.com/oidc/organization/<org-id>"dynamic_secret_role_arn = "arn:aws:iam::<account-id>:role/hcp-vault-secrets-dynamic-secret"integration_name = "<integration-name>"integration_role_arn = "arn:aws:iam::<account-id>:role/hcp-vault-secrets-integration"

The Terraform AWS provider can be used to provision the necessary resources.

1. Follow the Terraform documentation to authenticate the AWS provider.

2. Use your preferred text editor and create a Terraform configuration file with the following snippet:

   provider "aws" {}resource "aws_iam_user" "integration_user" {  name = "hcp-vault-secrets-integration"}resource "aws_iam_access_key" "integration_user_access_key" {  user = aws_iam_user.integration_user.name}resource "aws_iam_role" "dynamic_secret_role" {  name = "hcp-vault-secrets-dynamic-secret"  assume_role_policy = jsonencode({    "Version" : "2012-10-17",    "Statement" : [      {        "Effect" : "Allow",        "Action" : "sts:AssumeRole",        "Principal" : {          "AWS" : aws_iam_user.integration_user.arn        },        "Condition" : {}      }    ]  })  inline_policy {    name   = "hcp-vault-secrets-s3-lister"    policy = data.aws_iam_policy_document.dynamic_secret_policy.json  }}data "aws_iam_policy_document" "dynamic_secret_policy" {  # Replace with the permissions to grant to your dynamic secret  statement {    effect = "Allow"    actions = [      "s3:List*"    ]    resources = ["*"]  }}output "integration_access_key_id" {  value = aws_iam_access_key.integration_user_access_key.id}// Note that this will be written to the state file. // If you use this, please protect your backend state file.// https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_access_key#secretoutput "integration_secret_access_key" {  value = aws_iam_access_key.integration_user_access_key.secret  sensitive = true}output "dynamic_secret_role_arn" {  value = aws_iam_role.dynamic_secret_role.arn}

3. Initialize Terraform.

   $ terraform init

   This will prepare a working directory:

   ...snip...Terraform has been successfully initialized!

4. Generate your AWS IAM configuration with the apply command:

   $ terraform apply

   Review the actions Terraform is about to perform and say yes to accept the plan:

   ...snip...  Plan: 3 to add, 0 to change, 0 to destroy.    Changes to Outputs:  + dynamic_secret_role_arn       = (known after apply)  + integration_access_key_id     = (known after apply)  + integration_secret_access_key = (sensitive value)Do you want to perform these actions?Terraform will perform the actions described above.Only 'yes' will be accepted to approve.Enter a value: yes

5. Keep the Terraform outputs on hand for the next steps:

   Apply complete! Resources: 3 added, 0 changed, 0 destroyed.Outputs:dynamic_secret_role_arn = "arn:aws:iam::<account-id>:role/hcp-vault-secrets-dynamic-secret"integration_access_key_id = "AKIA..."integration_secret_access_key = <sensitive>

1. Provide a unique Integration Name for this integration.

2. Use the AWS IAM identity provider audience configured during the previous steps. The format is arn:aws:iam::<account-id>:oidc-provider/idp.hashicorp.com/oidc/organization/<org-id>.

3. Use the Integration AWS IAM role ARN configured during the previous steps. This role is used by HCP to manage credentials.

4. Click Add new integration to return to the new secret form.

   Note

   If you encounter an error, make sure the audience matches between HCP and AWS. Also verify the condition on the trust relationship for the AWS IAM role corresponds to your HCP organization ID, project ID and integration name.

1. Provide a unique Integration Name for this integration.

2. Use the Access key ID configured for the IAM user during the previous steps.

3. Use the Secret access key configured for the IAM user during the previous steps.

4. Click Add new integration to return to the new secret form.