EMILY YE: Developers often need a way
to generate temporary credentials
to access their Cloud accounts.
In this video, we'll show you how
to generate temporary Google Cloud Platform IAM
credentials as needed using HashiCorp Vault.
[MUSIC PLAYING]
Hi, I'm Emily, an engineer working on Google Cloud
Platform, an open source integration between Cloud
and HashiCorp Vault.
ANDY MANOSKE: And I'm Andy, a product manager
at HashiCorp on the Vault team.
Vault is a secrets management tool
that allows you to store, manage, and control access
to tokens, passwords, certificates,
and other types of secrets.
EMILY YE: In our last video, we used HashiCorp Vault to secure
an API key for our '80s-style arcade game, "Hyperspace,"
and gave our GCE instances an easy way to access secrets
on GCP using the Vault. Now let's talk about other ways we
can use Vault on GCP.
Let's say we want to add a daily leaderboard to our video game.
We'll have it update at midnight each day,
so it needs to access our video game data stored
in Spanner at least once a day.
Should we just give it its own service account key
and access to our Spanner database?
ANDY MANOSKE: Well, what happens if someone steals the service
account key?
If you don't have it locked down as well as the main app,
and it's all on automated process,
how would you detect if it gets stolen?
That won't be good.
What if you just gave it temporary access
to your project, like a temporary IAM credential?
EMILY YE: Yeah, that would work.
ANDY MANOSKE: So check out the GCP secrets backend for Vault
then.
A secret backend in HashiCorp Vault
is a pluggable interface that can store, generate, or alter
secrets.
The GCP secrets backend dynamically
creates OAuth access tokens based on IAM service accounts
and policies.
This means you can generate credentials
to access GCP as needed, without needing
to worry about how long those credentials last.
EMILY YE: That actually sounds like exactly what I need.
I could see how this would be useful in other cases, too.
Things like batch jobs or virtual training accounts
don't need access to your GCP project for very long
but can be hard to clean up after.
Developers could use Vault's GCP secrets
backend to assign the minimum permissions
to their initial service accounts
and obtain additional permissions only as needed.
ANDY MANOSKE: Want to try it out?
EMILY YE: Sure.
So as you can see, we already have our Vault server up
and running on GCP from last time.
We'll show you how a server admin sets up
the GCP secrets backend and how a user obtains a new secret
or a GCP OAuth access token.
ANDY MANOSKE: The admin needs to add configuration details
to his credentials.
The Vault server uses this config
to make requests to GCP to set up IAM permissions.
EMILY YE: Next, the admin needs to add Vault-specific role
sets.
These determine what permissions the service accounts created
by Vault will have.
The bindings argument is a configuration file
where we specify GCP IAM roles to assign to each resource.
ANDY MANOSKE: Can we take a closer look
at this bindings config file?
EMILY YE: Sure.
Each block in the configuration file
specifies a resource and a set of IAM roles.
As you can see in this block, we've
given the resource name for our Spanner database
that contains our scoring data and the role of database
reader.
This tells Vault to give generated service accounts
permissions to read the scoring data from the given database.
ANDY MANOSKE: So the secrets backend is set up then, right?
EMILY YE: Yep.
Let's switch to a different terminal
now and show how our leaderboard app gets an access token.
ANDY MANOSKE: To obtain our OAuth access token,
we read from the creds endpoint, specifying
the rule set we want to generate the token under.
Vault generates the token using a service account it creates
and then returns this token.
EMILY YE: When the TTL, or Time To Live, is up,
Vault revokes the lease and the access token in turn.
We can then use this OAuth token to call the Spanner API.
Now that we've finished our request of Spanner,
we don't need access.
Let's revoke this token manually.
That was really easy to do.
Andy, if other developers have questions
on setting this backend up, where
can they get more information?
ANDY MANOSKE: So the vaultproject.io page and look
up documentation on the GCP secrets backend.
EMILY YE: Thanks, Andy.
You can also check out other information
for running Vault on GCP, including
using the GCP authentication backends
or using GCP with other HashiCorp tools,
like Terraform.
See the links in description below.
Bye.
ANDY MANOSKE: Bye.
EMILY YE: Thanks, everyone, for watching.
We hope you found this series on using HashiCorp Vault with GCP
helpful.
Check out the links in the description
below, and don't forget to subscribe to the channel.