stenio123

"""
Get Vault credentials recursively as json.

Requirements: requests lib. Run pip to install it:

    $ pip install requests

To run this command:

    $ python get_credentials.py <initial url> <token>

stenio123

Example API calls interacting with Terraform Enterprise

Get list of workspaces

curl   --header "Authorization: Bearer ${TFE_TOKEN}"   --header "Content-Type: application/vnd.api+json"   $TFE_ADDR/api/v2/organizations/$TFE_ORG/workspaces | jq .

You can have the above in a loop, or to get a specific workspace:

# id of the first workspace returned

stenio123

Example AWS Terraform Enterprise Workflow

This document describes the steps required to demo an opinionated workflow deploying and managing AWS resources using Terraform Enterprise.

Requirements

In order to complete this demo, you need to have:

• a Terraform Enterprise account
• a git account

Workflow Type

stenio123

Whiteboard

stenio123

Demo

Browser:

• https://awwapp.com
• https://github.com/hashicorp/terraform-aws-nomad/tree/publish-amis/examples/nomad-consul-separate-cluster
• https://app.terraform.io/
• https://console.aws.amazon.com/
• http://NOMAD_SERVER_IP:4646/ui/jobs
• http://CONSUL_SERVER_IP:8500/ui/us-east-1/services
• https://github.com/stenio123/nomad-guides/tree/master/example-jobs

stenio123

# start vault in dev mode
VAULT_UI=true vault server -dev -dev-root-token-id="password"

# write some secrets for our example usage
curl --request POST \
     --silent \
     --header "X-Vault-Token: password" \
     --header "Content-Type: application/json" \
     --data '{ "options": { "cas": 0 }, "data": { "username": "administrator", "password": "hunter2" } }' \
     http://127.0.0.1:8200/v1/secret/data/dev | jq '.'

stenio123

Vault Namespaces Demo

Vault Namespaces supports a variety of ways of interacting with Vault.

# Config
vault namespace create marketing

echo '
path "secret/*" {
    capabilities = ["create", "read", "update", "delete", "list", "sudo"]

stenio123

Cubbyhole Single Use Secret

By leveraging the Cubbyhole secret engine, we can store a secret that only one token can retrieve. Once that token is expired or revoked, the secret is gone. When creating the token, you can limit number of uses.

# Creates token that will be shared. It will be used once to write a secret, second time to read then it is revoked
vault token create -use-limit=2 -policy=default -metadata="name=stenio"
# Output -<TOKEN>

stenio123

PKI Secret Engine

Create Limited Policy and Token for this demo

cat > pki.policy <<EOA
# Enable secrets engine
path "sys/mounts/*" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

stenio123

1. Clone git repository:

git clone git@github.com:stenio123/vault-ruby.git

2. Move to desired branch:

git checkout added-namespaces