Integrate with AWS Secrets Manager

1. Navigate to the Create New Policy section in the AWS IAM service

   1. Select the JSON tab

   2. Paste the following into the permissions policy editor:

      {
         "Version": "2012-10-17",
         "Statement": [
            {
                  "Sid": "HCPVaultSecretsAccess",
                  "Effect": "Allow",
                  "Action": [
                     "secretsmanager:DescribeSecret",
                     "secretsmanager:GetSecretValue",
                     "secretsmanager:CreateSecret",
                     "secretsmanager:PutSecretValue",
                     "secretsmanager:UpdateSecret",
                     "secretsmanager:UpdateSecretVersionStage",
                     "secretsmanager:DeleteSecret",
                     "secretsmanager:RestoreSecret",
                     "secretsmanager:TagResource",
                     "secretsmanager:UntagResource"
                  ],
                  "Resource": "*"
            }
         ]
      }
      

   3. Optionally provide tags

   4. Name your policy

   5. Click Create Policy

2. Navigate to the Create New Role section in the AWS IAM service

   1. Select Custom trust policy option

   2. Paste the following into the trust policy editor:

      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": "arn:aws:iam::879554817125:role/HCPVaultSecrets_Sync"
                  },
                  "Action": "sts:AssumeRole",
                  "Condition": {
                      "StringEquals": {
                          "sts:ExternalId": "<AWS_EXTERNAL_ID>"
                      }
                  }
              }
          ]
      }
      

   3. Populate the <AWS_EXTERNAL_ID> value with the AWS External ID of your HCP project.

      Note

      Your External ID can be found by navigating to the AWS sync integration page in HCP.

   4. Attach the Policy that was created in the previous step

   5. Name your role

   6. Click Create Role

3. View the Role you created and copy its ARN

4. You now have everything you need to complete the configuration process!

You can equally use the Terraform AWS provider to provision an AWS IAM role with the appropriate policy.

1. Follow the Terraform documentation to authenticate the AWS provider.

2. Use your preferred text editor and create a Terraform configuration file with the following resources:

   provider "aws" {
     // See https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration
     // for options on how to configure this provider. The following parameters or environment
     // variables are typically used.
   
     // Parameters:
     // access_key = ""
     // secret_key = ""
     // region     = ""
   
     // Environment variables:
     // AWS_ACCESS_KEY_ID
     // AWS_SECRET_ACCESS_KEY
     // AWS_REGION
   }
   
   variable "external_id" {
     type = string
     description = "External ID to securely delegate access to HCP Vault Secrets"
     sensitive = true
   }
   
   resource "aws_iam_role" "hashicorp_vault_secrets_role" {
     name = "HCPVaultSecrets"
     assume_role_policy = jsonencode({
       Version = "2012-10-17"
       Statement = [
         {
           Action = "sts:AssumeRole"
           Effect = "Allow"
           Principal = {
             AWS = "arn:aws:iam::879554817125:role/HCPVaultSecrets_Sync"
           }
           Condition = {
             StringEquals = {
               "sts:ExternalId" = var.external_id
             }
           }
         }
       ]
     })
   
     inline_policy {
       name   = "HCPVaultSecrets"
       policy = data.aws_iam_policy_document.hashicorp_vault_secrets_policy.json
     }
   }
   
   data "aws_iam_policy_document" "hashicorp_vault_secrets_policy" {
     statement {
       effect = "Allow"
       actions = [
         "secretsmanager:DescribeSecret",
         "secretsmanager:GetSecretValue",
         "secretsmanager:CreateSecret",
         "secretsmanager:PutSecretValue",
         "secretsmanager:UpdateSecret",
         "secretsmanager:UpdateSecretVersionStage",
         "secretsmanager:DeleteSecret",
         "secretsmanager:RestoreSecret",
         "secretsmanager:TagResource",
         "secretsmanager:UntagResource"
       ]
       resources = ["*"]
     }
   }
   
   output "role_arn" {
     description = "Role ARN to configure the AWS Secrets Manager Integration"
     value = aws_iam_role.hashicorp_vault_secrets_role.arn
   }
   

3. Initialize Terraform.

   $ terraform init
   

   This will prepare a working directory:

   ...snip...
   
   Terraform has been successfully initialized!
   

4. Generate your AWS IAM role with the apply command:

   $ terraform apply
   

   When prompted, paste the External ID value of your HCP project:

   Note

   Your External ID can be found by navigating to the AWS sync integration page in HCP.
   ...snip...
   
   var.external_id
     External ID to securely delegate access to HCP Vault Secrets
   
     Enter a value: <AWS_EXTERNAL_ID>
   

   Review the actions Terraform is about to perform and say yes to accept the plan:

   ...snip...
   
   Plan: 1 to add, 0 to change, 0 to destroy.
   
   Changes to Outputs:
      + role_arn = (known after apply)
   
   Do you want to perform these actions?
      Terraform will perform the actions described above.
      Only 'yes' will be accepted to approve.
   
   Enter a value: yes
   

5. Copy the AWS IAM Role from the Terraform outputs:

   Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
   
   Outputs:
   
   role_arn = "arn:aws:iam::123456789012:role/HCPVaultSecrets"
   

6. You now have everything you need to complete the configuration process!