{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/828","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/828/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/828/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/828/events","html_url":"https://github.com/hashicorp/vault/issues/828","id":121327143,"number":828,"title":"AWS identity document auth backend","user":{"login":"copumpkin","id":2623,"avatar_url":"https://avatars.githubusercontent.com/u/2623?v=3","gravatar_id":"","url":"https://api.github.com/users/copumpkin","html_url":"https://github.com/copumpkin","followers_url":"https://api.github.com/users/copumpkin/followers","following_url":"https://api.github.com/users/copumpkin/following{/other_user}","gists_url":"https://api.github.com/users/copumpkin/gists{/gist_id}","starred_url":"https://api.github.com/users/copumpkin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/copumpkin/subscriptions","organizations_url":"https://api.github.com/users/copumpkin/orgs","repos_url":"https://api.github.com/users/copumpkin/repos","events_url":"https://api.github.com/users/copumpkin/events{/privacy}","received_events_url":"https://api.github.com/users/copumpkin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-12-09T20:05:16Z","updated_at":"2015-12-23T17:22:50Z","closed_at":null,"body":"I've often wondered how I might bootstrap an AWS instance to authenticate to vault with no out-of-band manual intervention, by trusting AWS as an identity provider.\r\n\r\nThe existing `app-id` auth backend specifies that \r\n\r\n> An out-of-band process run by security operators map unique user IDs to these app IDs. Example: when an instance is launched, a cloud-init system tells security operators a unique ID for this machine. This process can be scripted, but the key is that it is out-of-band and out of reach of configuration management. (Path: map/user-id/)\r\n\r\nwhich can be painful for fully automated deployments, like in an AWS Autoscaling Group.\r\n\r\nI'm wondering if we could use a simple scheme that relies on the oft-overlooked signed identity document provided by an EC2 instance's metadata server. It lives at http://169.254.169.254/latest/dynamic/instance-identity/pkcs7 and is a simple JSON document that includes the instance ID, some pieces of metadata, and a signature by a canonical AWS key (which is unfortunately remarkably hard to find, but can be obtained).\r\n\r\nSince the document is signed once and there's no opportunity to inject a nonce into the document being signed, that document would need to be treated as a secret single-use authentication token. But if we do accept that, a brand new EC2 autoscaling instance could bootstrap itself into Vault in the following manner:\r\n\r\n1. On first boot, the EC2 instance generates a standard asymmetric keypair,\r\n2. The EC2 instance retrieves the pkcs7 signed identity document from the metadata service provided by the hypervisor,\r\n3. The EC2 instance contacts the Vault server over an encrypted channel, passing it the identity document and the newly generated public key,\r\n4. The Vault server verifies the AWS identity document signature, records/checks some metadata (e.g., launch time), and otherwise associates the public key with the instance. The Vault server should ensure that no identity document is used more than once.\r\n5. All future Vault authentication from that instance is performed in standard ways using the generated public key.\r\n\r\nAre my goals clear? Does this seem like a sensible way to achieve them?"},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/166948811","html_url":"https://github.com/hashicorp/vault/issues/828#issuecomment-166948811","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/828","id":166948811,"user":{"login":"copumpkin","id":2623,"avatar_url":"https://avatars.githubusercontent.com/u/2623?v=3","gravatar_id":"","url":"https://api.github.com/users/copumpkin","html_url":"https://github.com/copumpkin","followers_url":"https://api.github.com/users/copumpkin/followers","following_url":"https://api.github.com/users/copumpkin/following{/other_user}","gists_url":"https://api.github.com/users/copumpkin/gists{/gist_id}","starred_url":"https://api.github.com/users/copumpkin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/copumpkin/subscriptions","organizations_url":"https://api.github.com/users/copumpkin/orgs","repos_url":"https://api.github.com/users/copumpkin/repos","events_url":"https://api.github.com/users/copumpkin/events{/privacy}","received_events_url":"https://api.github.com/users/copumpkin/received_events","type":"User","site_admin":false},"created_at":"2015-12-23T17:22:50Z","updated_at":"2015-12-23T17:22:50Z","body":"I had to contact AWS support for it (:open_mouth:) since I couldn't find it anywhere on the public internet. I asked them to update their docs and they said they would do that soon, but also asked me not to distribute it myself. It's a certificate, but it has no chain that's traceable back to a trusted root.\r\n\r\nI'll ping them to see if they can publish it on the sooner side.\r\n"}}