Use AWS auth to Secure EC2 Instances with HashiCorp Vault

Contributed by: Prachi Jain

Difficulty level: Intermediate

HashiCorp Vault’s aws auth method provides an easy and secure way to authenticate EC2 instances to Vault and retrieve secrets. There are two ways of using aws auth - ec2 and iam. Both ways have a completely different workflow, and this Shortcut is focused on the ec2 way.

Prerequisites

1. You need a running Vault cluster. Refer to the Shortcut “Run HashiCorp Vault with Helm” for a refresher on running Vault. Ensure that your Vault cluster is available over the internet to allow your EC2 instance to connect to it.

2. You also need a running EC2 instance. If needed, refer to the official AWS documentation on launching an EC2 instance.

Update EC2 Instance

1. Create an IAM role in AWS with the following policy attached to it:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "sts:AssumeRole",
         "Resource": "*"
       }
     ]
   }
     

2. Attach the IAM role to your EC2 instance.

3. Install Vault on the EC2 instance per the official HashiCorp documentation.

Set Up AWS auth Method in Vault

1. Enable the aws auth method:

   vault auth enable aws

   You should see a success message.

2. Configure the aws auth method:

   vault write auth/aws/config/client access_key=<your-aws-access-key> secret_key=<your-aws-secret-key> region=<your-aws-region>

   You should see a success message like the following:

   Success! Data written to: auth/aws/config/client

3. Create a role.

   1. Copy your EC2 ...