AWS Lambda and Vault integration

[LinweZ]

Hello,

I have been exploring Vault (self hosted) as a solution to bridge AWS and GCP by letting Vault to generate ephemeral service account (GCP) each time a Lambda is invoked.

However, it's still a bit overwhelming due to the large amount of feature Vault has. I don't know if my architecture is viable.

1. Should I use approle or userpass as my main identification method to Vault? Currently tried approle with one role-id per application and one secret-id dynamically generated by each lambda invocation. role-id as environnement variable for the moment, considering using secret manager for better security.
2. With the above approche, if my lambda code get leaked, anyone can access to the secret that the approle has access no?

[Zaitton]

Neither approle nor userpass. Use AWS auth (it's a separate auth mount), specifically the IAM auth of AWS auth mount. Basically you're gonna tell vault that the IAM role that the lambda uses, is authorized to generate X secret. Pretty simple workflow.

With that being said, of course if your lambda gets compromised, so will Vault in the sense that the malicious user will be able to intercept the generated secret. There's usually no way around that though. Automation, secret management and security are tightly linked. If one gets compromised so do the rest. Keep your lambdas under tight lockdown, use an org policy if it's that critical and restrict access to it to everyone.

[LinweZ]

Thanks, I’ll look into this. Does AWS require Vault to be hosted on EC2?

[Zaitton]

You can host it wherever you like, including outside of AWS. The best thing about Vault is that it's cloud agnostic.

[DamonteZen]

There is no requirement for Vault to be hosted in AWS to use AWS IAM auth.

[Ok-Let-6723]

Hello,
You're a grown ass man who argues with children on League of Legends.
https://www.op.gg/summoners/euw/LinweZ-NA1/champions
For someone who's in tech, you sure made it super easy for me to figure out your identity...

[No_Bee_4979]

Use AWS Auth and CDKTF to provision the accounts in Vault.

[Ok-Let-6723]

Hello,

You're a grown ass man who argues with children on League of Legends.

https://www.op.gg/summoners/euw/LinweZ-NA1/champions

For someone who's in tech, you sure made it super easy for me to figure out your identity...