Manage credentials for HCP Terraform with Vault

As adoption of HCP Terraform grows, more organizations are incorporating it into their automated workflows and existing tooling. Interaction with the HCP Terraform API relies on auth tokens generated by the API. External systems use these tokens to automate actions in HCP Terraform, often as part of an organization’s CI/CD pipelines.

The Vault Terraform secrets engine enables you to generate, manage and revoke credentials for HCP Terraform and Terraform Enterprise while adhering to best practices of access and control.

In this tutorial, you will enable the secrets engine, configure it to generate credentials, and then manage those credentials.

Prerequisites

To perform the tasks described in this tutorial, you need to have:

• An HCP Vault cluster or a self-hosted Vault environment.
• HCP Terraform account and organization created.

Policy requirements

Each persona requires a different set of capabilities. These are expressed in policies. If you are not familiar with policies, complete the policies tutorial.

The admin tasks require these capabilities.

# Mount secrets engines
path "sys/mounts/*" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

# Configure the Terraform secrets engine and create roles
path "terraform/*" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

# Manage the leases
path "sys/leases/+/terraform/creds/my-user/*" {
  capabilities = [ "create", "read", "update", "delete", "list", "sudo" ]
}

path "sys/leases/+/terraform/creds/my-user" {
  capabilities = [ "create", "read", "update", "delete", "list", "sudo" ]
}

# Write ACL policies
path "sys/policies/acl/*" {
  capabilities = [ "create", "read", "update", "delete", "list" ]
}

# Manage tokens for verification
path "auth/token/create" {
  capabilities = [ "create", "read", "update", "delete", "list", "sudo" ]
}

The apps tasks require these capabilities.

# Get credentials from the terraform secrets engine
path "terraform/creds/my-user" {
  capabilities = [ "read" ]
}

Lab setup

The tutorial requires a HCP Terraform API key.

Retrieve HCP Terraform API key

1. Launch a web browser and navigate to https://app.terraform.io/session.

2. Click Continue with HCP account and sign in.

3. Expand your profile, and select Account settings.

4. From the side navigation, select Tokens.

5. Click Create an API token.

6. Enter "learn-vault" in the Description field.

7. Click Generate token.

8. Click the copy icon.

9. In a terminal, export the variable TF_TOKEN to the copied token value.

   $ export TF_TOKEN=<Copied Token>
   

   This token enables you to generate tokens for your HCP Terraform user account. Tokens generated for teams and organizations would be able to generate tokens for their respective scope.

Start Vault