Use password vaults

The following solutions are supported:

• 🔐 AWS Secrets Manager
• 🔐 Azure Key Vault
• 🔐 CyberArk
• 🔐 HashiCorp Vault
• 🔐 Keeper

This guide details the HashiCorp Vault integration. AWS Secrets Manager, Azure Key Vault, CyberArk, and Keeper follow a similar workflow: enable the feature flag, add the provider under Admin > Password Vaults, then reference stored secrets from a supported password field.

When the vault feature is enabled, password and secret fields offer Locally Stored or Vault Managed. These fields appear on resource handlers, connection info, IPAM, ITSM, data protection, network virtualization, LDAP, and source code repositories.

Once secrets resolve from a provider, you can optionally cache resolved values to reduce provider API traffic. See Cache vault secrets.

Prerequisites

Before integrating a vault provider, ensure the following requirements are met:

1. Vault configured

   • HashiCorp Vault:
     • HashiCorp Vault configured
     • Token or AppRole authentication method enabled and configured
     • Policy configuration for secret paths
     • For Vault Enterprise with namespaces: the namespace path and credentials valid within that namespace. Configure a CMP vault connection for each namespace.
   • Keeper:
     • Keeper Secrets Manager account
     • API access enabled
     • Client ID / API key
   • CyberArk:
     • Users, groups, and roles configured in your Conjur environment
     • Privileges and permissions assigned for secret access
     • Policies defining id, user, and assigned privileges. See more at CyberArk Developer Guide

2. Vault details

   Access to the following information:

   • Vault endpoint URL or hostname
   • Port number
   • Authentication tokens or credentials
     • Vault Token or AppRole
     • Keeper API key / Client ID
     • CyberArk identity & access configuration

Enable the vault feature flag

1. As a root user, SSH to the CMP appliance:

   sudo su -
   vi /var/opt/cloudbolt/proserv/customer_settings.py
   

2. Add the following lines to the customer_settings.py file:

   from settings import FEATURE_REGISTRY
   FEATURE_REGISTRY['vaults'] = True
   

3. Run the following commands:

   /opt/cloudbolt/manage.py features --reset
   systemctl restart httpd
   systemctl restart memcached
   

Add vault credentials

1. Log in to the CMP appliance as an administrator.

2. Go to Admin > Password Vaults.

3. Select Add and configure a vault provider.

   (opens full-size image in a new tab)

Add token credentials for a HashiCorp Vault

1. Select HashiCorp Vault.

   (opens full-size image in a new tab)

2. Provide a Name for the vault configuration.

3. For Authentication Method, select Token.

4. Enter the IP/Hostname, Port, Protocol, and Token for your vault.

5. For Vault Namespace, optionally enter the Vault Enterprise namespace to use for this connection, for example, admin/team-a. Leave blank to use the root namespace.

6. Select Create.

Add AppRole credentials for a HashiCorp Vault

Add AppRole credentials to allow CMP to authenticate to your HashiCorp Vault and retrieve stored secrets.

1. Go to Admin > Password Vaults.

2. Select Add.

3. Select HashiCorp Vault.

4. Provide a Name for the vault configuration.

5. For Authentication Method, select AppRole.

6. Enter the Approle Mount Path, IP/Hostname, Port, Protocol, AppRole Role ID, and AppRole Secret ID for your vault and AppRole.

   To locate the mount path, open HashiCorp Vault and go to Access > Authentication Methods. Use the path listed for AppRole (for example, approle) as the mount path.

   (opens full-size image in a new tab)

7. For Vault Namespace, optionally enter the Vault Enterprise namespace to use for this connection, for example, admin/team-a. Leave blank to use the root namespace.

8. Select Create.

After you select Create, CMP automatically attempts to verify the connection to the vault. If verification fails, an error message appears. You can also select Verify Connection to test the connection manually.

Edit credentials for a HashiCorp Vault

Update the Token or AppRole credentials that CMP uses to authenticate to your HashiCorp Vault and retrieve stored secrets.

1. Go to Admin > Password Vaults.

2. Select the vault entry to update.

3. Select Edit.

   (opens full-size image in a new tab)

4. Update any required fields.

   (opens full-size image in a new tab)

   Default secret cache TTL and Default secret cache TTL unit set the cache duration inherited by new secret mappings created under this vault. Changing them does not affect existing mappings. Leave them unset to resolve secrets on every access. See Cache vault secrets.

5. Select Save.

After you select Save, CMP attempts to verify the connection to the vault. If verification fails, CMP displays an error message and does not save changes. You can also select Verify Connection to manually test the connection.

Configure resource handler to use vault credentials

Use HashiCorp Vault credentials in a resource handler

Access HashiCorp Vault secret information

1. Go to the secrets engine in your HashiCorp Vault and locate the secret.

   (opens full-size image in a new tab)

2. Take note of the secret path and key name.

In this example, the path is /cubbyhole/dev, and the name is secret_key.

Use HashiCorp Vault Token credentials in a resource handler

1. Go to Admin > Resource Handlers.
2. Select the target resource handler.
3. Select Edit Credentials.
4. For Password, select Vault Managed.
5. Select the Token credential.
6. Provide the path and secret key name.
7. Select Save.

Use HashiCorp AppRole credentials in a resource handler

Configure a resource handler to authenticate to a vault using AppRole and retrieve a secret.

1. Go to Admin > Resource Handlers.
2. Select the target resource handler.
3. Select Edit Credentials.
4. Next to Password, select Vault Managed.
5. Select the AppRole credential.

Continue for details on retrieving secrets stored in the Cubbyhole or Key/Value (KV) secrets engines.

To configure a resource handler to access a secret in a Cubbyhole secrets engine:

1. Provide the secret path in the path field.

   Cubbyhole does not offer a “copy path” button, but you can use the breadcrumb path shown in the vault (for example, /cubbyhole/aws).

2. Copy the key name and enter it in the key name field.

   Cubbyhole secrets can only be accessed using the creating token. To retrieve a Cubbyhole secret with an AppRole credential, the secret must have been created with that same credential.

3. Select Save.

To configure a resource handler to access a secret in a KV secrets engine:

1. Copy the secret’s API path and provide it in the path field.

   If the path begins with /v1 (the Vault API version prefix), remove /v1

   Example: /v1/kv/data/aws/credentials becomes /kv/data/aws/credentials

2. Copy the key name and enter it in the key name field.

   For KV v2, prepend the key name with data.

   Example: AWS_SECRET_ACCESS_KEY becomes data.AWS_SECRET_ACCESS_KEY

   Refer to HashiCorp’s KV version comparison page for details on the differences between version 1 and version 2.

3. Select Save.

After you select Save, CMP attempts to retrieve the vault secret and authenticate to the provider (for example, AWS). If authentication fails, CMP displays an error message. You can also select Verify Connection to manually test the connection.

Use CyberArk credentials in a resource handler

Use the <policy-id>/<variable-name> format to reference a value, for example aws/secret_access_key.

Use vault credentials in a connection info

Store a connection info password in a vault instead of locally in CMP.

1. Go to Admin > Connection Info.

2. Select the connection info to update, then select Edit.

3. For Password, select Vault Managed.

4. Select the vault credential, then provide the path and secret key name.

   (opens full-size image in a new tab)

   The path and key name formats are the same as for a resource handler. For Cubbyhole and KV examples, see Use HashiCorp AppRole credentials in a resource handler.

5. Select Save.

View where a vault is used

The Secrets tab on a vault lists every CMP field that reads a secret from that vault. Check this tab before you change or remove a secret in the vault provider, or before you delete the vault from CMP.

1. Go to Admin > Password Vaults.

2. Select the vault.

3. Select the Secrets tab.

   (opens full-size image in a new tab)

Each row is one vault-managed field:

Use the search box to filter by object name, attribute, or secret path.

Manage vaults with the API

You can also manage vault providers and vault-managed fields through the CMP v3 API.

For request and response details, open the API console on your CMP appliance and go to the Password Vaults section. See REST API.