Code Monkey home page Code Monkey logo

hashicorp-vault-utils's Introduction

Intro

This tool is a demonstration of my blog post. It's allow us fetching encrypted Vault recovery key from storage backend (filesystem/consul supported at the moment) and decrypt it with AWS KMS.

Feature

  • Getting encrypted recovery key from local filesystem and consul
  • Decrypt recovery key with AWS KMS service
  • Allow specify key share & threshold to split recovery key. (Default to recovery config stored in backend)

Example

hashicorp-vault-utils --aws-profile dev --backend file --file-path /data/vault

Usage

NAME:
   hashicorp-vault-utils - Misc for fun

USAGE:
   hashicorp-vault-utils [global options] command [command options] [arguments...]

COMMANDS:
   help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --recovery-shares value        Number of key shares to split the recovery key into (default: Automatically fetch from saved recovery config)
   --recovery-threshold value     Number of key shares required to reconstruct the recovery key (default: Automatically fetch from saved recovery config)
   --backend value                storage backend name (file/consul) (default: file)
   --consul-address value         Specifies the address of the Consul agent to communicate with. (default: http://127.0.0.1:8500)
   --consul-path value            Specifies the path in Consul's key-value store where Vault data will be stored (Default: 'vault/') (default: vault/)
   --file-path value              The absolute path on disk to the directory where the data will be stored
   --aws-access-key-id value      AWS Access Key ID
   --aws-secret-access-key value  AWS Secret Access Key
   --aws-session-token value      AWS Session Token
   --aws-region value             AWS Region (default: "eu-west-1")
   --aws-profile value            AWS Profile name
   --help, -h                     show help (default: false)

hashicorp-vault-utils's People

Contributors

cucxabong avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar

hashicorp-vault-utils's Issues

Any way to fetch recovery key shares

Have just tried your tool for fetching the vault recovery key out of consul.

It appears to be working however a vault init gives me results like: (bogus values)

$ vault operator init
Recovery Key 1: hs8STRrBD21434912340432423442SjFHKaSvH8QHY
Recovery Key 2: j34Z234932043sdfliweG5f1fK81k+4JewhhxeaZeGFxhL
Recovery Key 3: +0wX6oOdluIc8Usm2sf921sffssmu8IwsQzyAPcXiy0h
Recovery Key 4: JLX27y6M4tdC1nhcMModki23c9flsdfk22+r42ssiSaVEP
Recovery Key 5: jjgz+mE9rm/AGv1kg+Xldsjwesdiwelsdi21324H6wc3xlq3y

But your tool only outputs a single value like: (bogus value)

wK9nVh/7wqVNevilwerif234vsgFIUVF83VEp1vgJ0=

If I understand your article this is the base64 encoded version of the actual recovery key and the above are shamir's slices of the recovery key.

But to use it I need the slices. Is there a way to get that output.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.