I have a server application (on dynamic infrastructure) which needs to retrieve a secret from Hashicorp Vault during startup.
Lets assume we need make this as secure as possible. From the docs and examples about AppRole authentication i understand that, after a Vault admin has created the approle and the secret, the application needs to be configured with
- The app role name
- A token which allows to retrieve the app role id and create a new secret identifier under that role
- The hostname/port and of the Vault server + SSL certificates
Then the application fetch the role id and create a new secret id (pull mode). With these both id's the application can now
perform a login on the Vault server to retrieve the final token which is used to retrieve the secret.
During this flow we could also wrap and unwrap every response (cubbyhole response wrapping) by setting
X-Vault-Wrap-TTL and use
sys/wrapping/unwrap endpoint to unwrap.
First question: Does pull mode and/or response wrapping does really make sense here? I can not see the value of creating a secret id just to use it later for login. I can also not see why i want to wrap my responses just to unwrap them.
If the above is correct then it looks to me that every person/machine which knows the role name and does have a token to fetch the role id and create a secret is able to retrieve the secret.
Second question: Having the app role name and the initial token in my configuration file does not make them really more secure because everyone which has access to the Vault server just can read the secret with that. It seems that it would make sense to split configuration: Have the app role name in the config file and the token somewhere else (in an env variable, etc).
Third question: The deprecated (push based) App ID seems to make more sense to me (for my case) because i can put the app id in the configfile and the use a machine specific user id (like the mac address, ip address, hostname, etc) as the second secret. So why does pull mode AppRole authentication is preferred over push mode or App ID?