stenio123

Cubbyhole Single Use Secret

By leveraging the Cubbyhole secret engine, we can store a secret that only one token can retrieve. Once that token is expired or revoked, the secret is gone. When creating the token, you can limit number of uses.

# Creates token that will be shared. It will be used once to write a secret, second time to read then it is revoked
vault token create -use-limit=2 -policy=default -metadata="name=stenio"
# Output -<TOKEN>

stenio123

Vault Namespaces Demo

Vault Namespaces supports a variety of ways of interacting with Vault.

# Config
vault namespace create marketing

echo '
path "secret/*" {
    capabilities = ["create", "read", "update", "delete", "list", "sudo"]

stenio123

# start vault in dev mode
VAULT_UI=true vault server -dev -dev-root-token-id="password"

# write some secrets for our example usage
curl --request POST \
     --silent \
     --header "X-Vault-Token: password" \
     --header "Content-Type: application/json" \
     --data '{ "options": { "cas": 0 }, "data": { "username": "administrator", "password": "hunter2" } }' \
     http://127.0.0.1:8200/v1/secret/data/dev | jq '.'

stenio123

Demo

Browser:

• https://awwapp.com
• https://github.com/hashicorp/terraform-aws-nomad/tree/publish-amis/examples/nomad-consul-separate-cluster
• https://app.terraform.io/
• https://console.aws.amazon.com/
• http://NOMAD_SERVER_IP:4646/ui/jobs
• http://CONSUL_SERVER_IP:8500/ui/us-east-1/services
• https://github.com/stenio123/nomad-guides/tree/master/example-jobs

stenio123

This code shows the steps to enable the transit secret engine, configure a key, and use the sign leveraging Vault.

vault secrets enable transit

# Default key type doesn't support signing
vault write -f transit/keys/my-key type=rsa-4096

# Encode a string as base64
echo -n 'This was created by Stenio, you can trust me!' | openssl base64

stenio123

Whiteboard

stenio123

Example Azure Terraform Enterprise Workflow

This document describes the steps required to demo an opinionated workflow deploying and managing Azure resources using Terraform Enterprise.

Requirements

In order to complete this demo, you need to have:

• a Terraform Enterprise account
• a git account

Steps

stenio123

Example AWS Terraform Enterprise Workflow

This document describes the steps required to demo an opinionated workflow deploying and managing AWS resources using Terraform Enterprise.

Requirements

In order to complete this demo, you need to have:

• a Terraform Enterprise account
• a git account

Workflow Type

stenio123

Example API calls interacting with Terraform Enterprise

Get list of workspaces

curl   --header "Authorization: Bearer ${TFE_TOKEN}"   --header "Content-Type: application/vnd.api+json"   $TFE_ADDR/api/v2/organizations/$TFE_ORG/workspaces | jq .

You can have the above in a loop, or to get a specific workspace:

# id of the first workspace returned

stenio123

"""
Get Vault credentials recursively as json.

Requirements: requests lib. Run pip to install it:

    $ pip install requests

To run this command:

    $ python get_credentials.py <initial url> <token>