A new platform for documentation and tutorials is launching soon.
We are migrating Vault documentation into HashiCorp Developer, our new developer experience.
»Vault Agent Auto-Auth AWS Method
aws method performs authentication against the AWS Auth
authentication types are supported. If
ec2 is used, the agent will store the
reauthentication value in memory and use it for reauthenticating, but will not
persist it to disk.
Due to the complexity of the Trust On First Use (TOFU) model used in the
method, we recommend the
iam method when possible.
Vault will use the AWS SDK's normal credential chain behavior, which means it will use the first valid credentials it finds in the following order:
- A static credential configuration
- Environment variables
- A file containing credentials
- From any identity services available in its physical environment like container environment variables or role-based instance metadata
Wherever possible, we recommend using identity services (method 4) for credentials.
These rotate regularly and require no effort on your part to provision, making
identity services the most secure of the four methods. If using identity services and a custom
credential_poll_interval, be sure the frequency is set low enough to pick up new credentials
from the physical environment as they become available.
To use identity services, choose the
iam type and leave the
parameters unset in your configuration.
(string: required)- The type of authentication; must be
(string: required)- The role to authenticate against on Vault.
(integer: optional)- In seconds, how frequently the Vault agent should check for new credentials if using the iam type.
(string: optional)- When using static credentials, the access key to use.
(string: optional)- When using static credentials, the secret key to use.
(string: "us-east-1")- The region to use for signing the authentication request. The region Agent uses should match that corresponding to
sts_endpoint, if a custom endpoint has been configured on the Vault server.
(string: optional)- The session token to use for authentication, if needed.
(string: optional)- If not provided, Vault will generate a new UUID every time
vault agentruns. If set, make sure you understand the importance of generating a good, unique
nonceand protecting it. See Client Nonce for more information.
Refer to the Vault Agent with AWS tutorial to learn how to integrate Vault with IAM AWS' native authentication.