vault-plugin-secrets-minio
NOTE: This is a very initial release of this code, please test in a non-critical environment before you use it.
This is a plugin for HashiCorp Vault which will provision multi-user keys for the Minio object storage server. A good deal of help was gleaned from the vault-plugin-secrets-helloworld plugin from @daveadams, and the Vault builtin AWS and database secrets engines.
Usage
Once the plugin is registered with your vault instance, you can enable it on a particular path:
$ vault secrets enable \
-path=minio \
-plugin-name=vault-plugin-secrets-minio \
-description="Instance of the Minio plugin" \
plugin
Configuration
In order to configure the plugin instance, you must supply it with your Minio endpoint, the access key ID, and the secret access key for the Minio initial user.
$ vault write minio/config \
endpoint=<minio ip>:<minio port> \
accessKeyId=<minio access key ID> \
secretAccessKey=<minio secret access key> \
useSSL=<true|false>
You can read the current configuration:
$ vault read minio/config
Roles
Before you can issue keys, you must define a role. A role defines the policy which will be applied to the newly created user, and a name prefix for the key.
$ vault write minio/roles/example-role \
policy=<existing minio policy name>
user_name_prefix=<user name prefix>
<user name prefix> is prefixed to the Vault request id for a key request,
and defaults to an empty string. Having the Vault request id as the
latter part of the name allows you to trace the key issuer via the Vault
audit log. You may also optionally supply a default_ttl and max_ttl
which will apply to the lease created by this role.
$ vault read minio/roles/example-role
Returns the configuration for a particular role.
$ vault list minio/roles
Lists all configured roles.
Provisioning keys
$ vault read minio/keys/example-role
Returns the accessKeyId, secretAccessKey, policy and account status for the newly generated key.
Disclaimer
Full Disclosure: At this time I am an employee of HashiCorp, but this project is entirely personal and is not an official product of HashiCorp, Inc.