{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/805","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/805/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/805/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/805/events","html_url":"https://github.com/hashicorp/vault/pull/805","id":119392571,"number":805,"title":"AWS KMS authentication backend","user":{"login":"Buzer","id":1392503,"avatar_url":"https://avatars.githubusercontent.com/u/1392503?v=3","gravatar_id":"","url":"https://api.github.com/users/Buzer","html_url":"https://github.com/Buzer","followers_url":"https://api.github.com/users/Buzer/followers","following_url":"https://api.github.com/users/Buzer/following{/other_user}","gists_url":"https://api.github.com/users/Buzer/gists{/gist_id}","starred_url":"https://api.github.com/users/Buzer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Buzer/subscriptions","organizations_url":"https://api.github.com/users/Buzer/orgs","repos_url":"https://api.github.com/users/Buzer/repos","events_url":"https://api.github.com/users/Buzer/events{/privacy}","received_events_url":"https://api.github.com/users/Buzer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/hashicorp/vault/milestones/7","html_url":"https://github.com/hashicorp/vault/milestones/future","labels_url":"https://api.github.com/repos/hashicorp/vault/milestones/7/labels","id":1389700,"number":7,"title":"future","description":null,"creator":{"login":"jefferai","id":28627,"avatar_url":"https://avatars.githubusercontent.com/u/28627?v=3","gravatar_id":"","url":"https://api.github.com/users/jefferai","html_url":"https://github.com/jefferai","followers_url":"https://api.github.com/users/jefferai/followers","following_url":"https://api.github.com/users/jefferai/following{/other_user}","gists_url":"https://api.github.com/users/jefferai/gists{/gist_id}","starred_url":"https://api.github.com/users/jefferai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jefferai/subscriptions","organizations_url":"https://api.github.com/users/jefferai/orgs","repos_url":"https://api.github.com/users/jefferai/repos","events_url":"https://api.github.com/users/jefferai/events{/privacy}","received_events_url":"https://api.github.com/users/jefferai/received_events","type":"User","site_admin":false},"open_issues":13,"closed_issues":1,"state":"open","created_at":"2015-11-02T19:27:40Z","updated_at":"2015-12-03T20:29:37Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2015-11-29T22:29:27Z","updated_at":"2015-12-04T17:02:21Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/hashicorp/vault/pulls/805","html_url":"https://github.com/hashicorp/vault/pull/805","diff_url":"https://github.com/hashicorp/vault/pull/805.diff","patch_url":"https://github.com/hashicorp/vault/pull/805.patch"},"body":"This enables using AWS's KMS service to map keys to Vault's policies and partly fixes #406 .\r\n\r\nThe idea behind using AWS KMS is that you can assign kms:Encrypt permission on KMS key to IAM role and assign that role to an instance. Instance can then create an encrypted token that can be sent to Vault. While it's not extremely vital that only Vault has kms:Decrypt permission (as token only contains the validity information), it is recommended.\r\n\r\nI haven't ran any manual tests yet (only acceptance), so I don't recommend merging this yet, but I'm open to feedback about current state & if there are things that should be changed."},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/162022245","html_url":"https://github.com/hashicorp/vault/pull/805#issuecomment-162022245","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/805","id":162022245,"user":{"login":"fieldju","id":711726,"avatar_url":"https://avatars.githubusercontent.com/u/711726?v=3","gravatar_id":"","url":"https://api.github.com/users/fieldju","html_url":"https://github.com/fieldju","followers_url":"https://api.github.com/users/fieldju/followers","following_url":"https://api.github.com/users/fieldju/following{/other_user}","gists_url":"https://api.github.com/users/fieldju/gists{/gist_id}","starred_url":"https://api.github.com/users/fieldju/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fieldju/subscriptions","organizations_url":"https://api.github.com/users/fieldju/orgs","repos_url":"https://api.github.com/users/fieldju/repos","events_url":"https://api.github.com/users/fieldju/events{/privacy}","received_events_url":"https://api.github.com/users/fieldju/received_events","type":"User","site_admin":false},"created_at":"2015-12-04T17:02:21Z","updated_at":"2015-12-04T17:02:21Z","body":"@Buzer I have a couple questions regarding the following.\r\n> The idea behind using AWS KMS is that you can assign kms:Encrypt permission on KMS key to IAM role and assign that role to an instance. Instance can then create an encrypted token that can be sent to Vault.\r\n\r\nHow does this flow work, more specifically:\r\n\r\n1. How would an administrator connect a KMS key to a Vault policy.\r\n2. What does the flow look like for a client to authenticate and receive back a token with permissions associated with the policy.\r\n\r\nI would love to see documentation or examples of how the above would look.\r\nI am imagining the flow as the following\r\n1. In the instance that needs to be authenticated I use KMS to encrypt something*[1]\r\n2. I call the auth endpoint*[2]\r\n3. Vault decrypts the token and returns a token for the policy that was mapped to the key.\r\n\r\n1. What is the client encrypting?\r\n2. What does the API for this Auth Backend look like?\r\nI found the following in the code\r\n\r\n> Example: vault auth -method=awskms key=12345678-90ab-cdef-1234-567890abcdef\r\n\r\nBut thats just the KMS key right?\r\n\r\nI am going to try and answer some of this questions myself by digging through the code, which might take me a while since I am not a GO expert.\r\n\r\nI am one of the people watching https://github.com/hashicorp/vault/issues/406\r\nI have been thinking about this problem recently and was entertaining the idea of the following concept of using pure IAM and AWS Policies.\r\n1. Client signs a request using IAM creds and the V4 signature process to assume there own role (This requires that the IAM role has STS perms to assume there own role) \r\n2. You take the signed auth headers and send them to the Vault IAM Auth Backend\r\n3. Vault uses your signed auth headers to assume the role you claim to have, and validates the role from the STS assume role api response.\r\n4. Vault returns the policy attached to the role.\r\n\r\nHere is a POC gist outlining this flow https://gist.github.com/fieldju/630c8c5375772297a612\r\n\r\nThe draw back to that flow is that Vault would be assuming roles and getting more perms then it really needs.\r\n\r\nI want to know more about this KMS flow and get the folks in issue 406 and this issue all on the same page and like @jefferai was saying reach a community consensus on best practice regarding authentication for AWS Instances.\r\n\r\n"}}