Slide 1
Slide 1 text
HashiCorp Vault
for
Drupalers
Drupal HackCamp 2018 - București
Slide 2
Slide 2 text
Nick Santamaria
● Drupal developer since 2006
● SysOps Engineer at PreviousNext
● Based in Melbourne, Australia
● HashiCorp Fan
@nicksanta
github.com/nicksantamaria
drupal.org/user/87915
Slide 3
Slide 3 text
The Secret Management Problem
Slide 4
Slide 4 text
What are Secrets?
A piece of information that
proves an identity, or
authorization to perform
certain functions.
● Username & Password
● API Token
● TLS Certificate
Slide 5
Slide 5 text
What are Secrets?
Things in this realm must be
carefully handled.
● Who has access?
● When did they access
it?
● How will they be
rotated?
Slide 6
Slide 6 text
In the Wild
They are in your settings.php
files.
Slide 7
Slide 7 text
In the Wild
They are in your config exports.
Slide 8
Slide 8 text
In the Wild
They are in your ansible
playbooks.
Slide 9
Slide 9 text
Secret Sprawl
Slide 10
Slide 10 text
HashiCorp Vault
Slide 11
Slide 11 text
The Secret Management Problem
Vault addresses the
challenges of secrets
management.
● Centralised
● Fine-grained access
control
● Audit trail
Slide 12
Slide 12 text
“moving from a world of sprawl to a world of
centrality; with strong guarantees around
encryption, access control, and visibility.”
- Armon Dadgar, HashiCorp CTO
Slide 13
Slide 13 text
The Application Problem
or: Software sucks at keeping secrets
Slide 14
Slide 14 text
The Application Problem
Applications will inevitably
expose secrets.
● Logs
● Stack traces
● Monitoring tools
Slide 15
Slide 15 text
Dynamic Secrets
Slide 16
Slide 16 text
Dynamic Secrets
Issue applications
short-lived credentials.
● Created dynamically
● Ephemeral
● Require lease renewals
Slide 17
Slide 17 text
A constantly moving
target for attackers.
Slide 18
Slide 18 text
Dynamic Secrets
Each client receives unique
credentials.
● Identify the specific point
of breach.
● Revoke credentials for
the compromised client.
Slide 19
Slide 19 text
The Encryption Problem
or: Cryptography is hard
Slide 20
Slide 20 text
The Encryption Problem
Cryptography is simple to
get wrong and can
undermine its integrity.
Key lifecycle management
is even harder.
Slide 21
Slide 21 text
Encrypt-as-a-Service
Slide 22
Slide 22 text
Encrypt as a
Service
Create named keys.
Slide 23
Slide 23 text
Encrypt as a
Service
High-level APIs for
cryptographic functions.
Slide 24
Slide 24 text
Encrypt as a
Service
High-level APIs for
cryptographic functions.
Slide 25
Slide 25 text
Encrypt as a
Service
High-level APIs for key lifecycle
management.
Slide 26
Slide 26 text
Secret Management
Dynamic Secrets
Encrypt-as-a-Service
Slide 27
Slide 27 text
Vault Architecture
Slide 28
Slide 28 text
Vault Architecture - Core
Core
● Lifecycle management.
● Ensures requests handled
properly.
Slide 29
Slide 29 text
Vault Architecture - Authentication
Core
Allows clients to authenticate from
other systems
Authentication
Slide 30
Slide 30 text
Vault Architecture - Audit
Core
● Logs request / response trail.
● Who has done what.
Authentication
Audit Logs
Slide 31
Slide 31 text
Vault Architecture - Storage
Core
● Stores encrypted data at rest.
● Highly Available.
● Durable.
Authentication
Storage
Audit Logs
Slide 32
Slide 32 text
Vault Architecture - Secret Engines
Core
Provides access to different secrets.
Authentication
Storage
Audit Logs
Secret Engines
Slide 33
Slide 33 text
Drupal Integration
Slide 34
Slide 34 text
Vault Architecture - Drupal Integration
Core
Authentication
Secret
Engines
Authentication
Provider Plugins
● Key integration
● Encrypt integration
Lease Maintenance
Vault Client service
Slide 35
Slide 35 text
drupal.org/project/vault
Slide 36
Slide 36 text
Drupal Integration - Current State
Authentication Providers
● Token - drupal.org/project/vault_auth_token
Slide 37
Slide 37 text
Drupal Integration - Current State
Secret Engines
● Key/Value - drupal.org/project/vault_key_kv
● AWS - drupal.org/project/vault_key_aws
Slide 38
Slide 38 text
Drupal Integration - Current State
Encrypt-as-a-Service
● Transit Encryption - drupal.org/project/encrypt_vault_transit
Slide 39
Slide 39 text
Drupal Integration - Current State
Planned
● AppRole Authentication
● TLS Authentication
● TOTP Provider for TFA - drupal.org/project/tfa
Slide 40
Slide 40 text
Drupal Integration - Design Goals
✔ Modular - Each module
provides a single function.
✔ Auditable - Simple
implementation for easy
code review.
✔ Simple - Vault module
only responsible for:
1. Plugin manager for
authentication providers.
2. Expose authenticated
client as a service.
3. Maintain leases (via
cron).
Slide 41
Slide 41 text
Drupal Integration - not Design Goals
✗ Provide management layer for Vault.
✗ Mitigate bad/insecure vault configuration.
✗ Support dynamic database credentials.
Slide 42
Slide 42 text
Demo!
Slide 43
Slide 43 text
No content
Slide 44
Slide 44 text
No content
Slide 45
Slide 45 text
No content
Slide 46
Slide 46 text
drupal.org/node/2972436
Ability to map specific values from multi-value keys to config overrides
Slide 47
Slide 47 text
Thank you!
@nicksanta
github.com/nicksantamaria
drupal.org/user/87915
Session Feedback