Protect YugabyteDB with Hashicorp Vault.pdf

This presentation present how we can use Vault to secure DB credentials

1. ©2024 HASHICORP 1
Protect YugabyteDB with
Hashicorp Vault
Etourneau Gwenn
Staff Resident Architect
YugabyteDB Tokyo #5
2024/07/17

2. ©2024 HASHICORP2
Table of
Contents/
Agenda
Vault
About Me
Dynamic Database Credentials
Examples
#

#

#
#

3. ©2024 HASHICORP
About Me

Etourneau Gwenn
Previous company
Staff Resident Architect
Yugabyte - Principal Solution Architect
Woven By Toyota - Staff Platform Architect
Pivotal - Advisory Architect
Rakuten - PaaS team & Technical lead
…
20+ exp.

4. ©2024 HASHICORP
01
Vault
4

5. ©2024 HASHICORP5
In dynamic cloud infrastructure,
security starts with identity.
Identity-based security uses trusted
identities to automate access to secrets,
data, and applications
Security system of record to centrally store
and protect secrets across clouds and
applications
Lifecycle management of your credentials to
ensure proper oversight, rotation, and expiry
Authenticate and authorize every access request
Client
Token
Authentication System
AD LDAPIAM

6. ©2024 HASHICORP6
Identity-based security
Automate secure access and lifecycle
management for credentials and sensitive data
Secrets Certificates Keys Data Protection
Static
Rotated
Dynamic
Database
PKI
Managed Keys
KMS
KMIP
HSM
Encryption
Signatures
Tokenization

7. ©2024 HASHICORP
01
Dynamic Database
Credentials

7

8. ©2024 HASHICORP
●Generates database credentials dynamically based on configured roles
●Are a mechanism to easily provide every service/instance unique credentials for DB access
●Vault’s leasing mechanism is employed to easily rotate credentials
Database Secrets Engines
8

9. ©2024 HASHICORP
●Dynamic user/application credentials
●Root credential rotation
●Static Roles
Database Credential Types
9

10. ©2024 HASHICORP
●On demand short-lived credentials for application and user requests
●Can be scoped to specific grant statements
●Revoked at TTL expiration
●Applications or users that need occasional access provision it as needed and credentials do not
exist when not in use
Dynamic Database Credentials
10
Request DB Credentials
Create USER …
WITH PASSWORD
Return Dynamic Credential
(Valid for X Days)

11. ©2024 HASHICORP
●Automatic rotation of database
user account passwords
●Ideal for longer-lived connections
i.e. service accounts
●Align with security best practices
and compliance policy
Static Database Roles
11
1
1
3
2
Create a static role
Request credentials
Return credentials
2
3
4
4Connect to DB

12. ©2024 HASHICORP
●Periodically rotate root database
password
●Maintain GRC / Security policy
compliance
●Rotate root credentials after initial
database configuration - only
Vault will have the privileged
credentials
Root Credential Rotation
12
3
12
1
3
2
Configured with priv. DB Credentials
App Gets a unique set of DB Credentials
Rotate root credentials
Read / Write from DB
app
username: root
Password: rootpassword
username: root
password: newpassword

13. ©2024 HASHICORP
01
YugabyteDB
13

14. ©2024 HASHICORP
●PostgreSQL +++
●Scalability
YugabyteDB
14
●Built-in Resilience
●Enterprise

15. ©2024 HASHICORP
Database Secrets Engines
DocDB Storage Layer
Distributed, transactional document store
with sync and async replication support
YSQL
hashicorp-vault-ysql-plugin
YCQL
cassandra-database-plugin
Extensible Query Layer
Extensible query layer to support multiple API’s
https://github.com/yugabyte/hashicorp-vault-ysql-plugin

16. ©2024 HASHICORP
Database Secrets Engines
●Can also use build in postgres plugin but will not be able to the yugabyte capability

17. ©2024 HASHICORP
03
Examples

17

18. ©2024 HASHICORP
vault secrets enable database
First steps
18
Enable DB secret engine
vault write database/config/postgresql \
plugin_name=ysql-plugin \
connection_url="postgresql://{{username}}:{{password}}@$POSTGRES_URL/postgres? load_balance=true&yb_
servers_refresh_interval =0" \
allowed_roles="*" \
username="root" \
password="rootpassword"
Configure Vault

19. ©2024 HASHICORP
Root Credential Rotation
19
vault write -force database/ rotate-root/postgresql
Rotate root credentials1

20. ©2024 HASHICORP
vault read database/creds/my-role
Dynamic Database Roles
20
Get credentials 2
vault write database/roles/ my-role \
db_name="my-postgresql-database" \
creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD
'{{password}}' VALID UNTIL '{{expiration}}'; \
GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
default_ttl="1h" \
max_ttl="24h"
Configure Role in Vault1

21. ©2024 HASHICORP
vault read database/creds/my-static-role
Static Database Roles
21
Get credentials 2
vault write database/static-role/ my–static-role \
db_name="my-postgresql-database" \
username="myusername" \
default_ttl="1h" \
max_ttl="24h"
Configure Username in Vault1

22. ©2024 HASHICORP
Rotation
22
vault write database/static-role/ my-static-role \
. . .
rotation_period="1h"
rotation_schedule=CRON

23. ©2024 HASHICORP
Thank you
[email protected]