基于HashiCorp Vault Approle与Terraform解决零密钥挑战（可信实体）

1. 配置Vault：设置可信编排器（Terraform）与响应包装 #

1.1 启用AppRole认证方法 #

在Vault服务器上执行：

vault auth enable approle

1.2 创建Terraform专用Policy #

创建terraform-orchestrator-policy.hcl文件：

path "auth/approle/role/terraform-role/secret-id" {
  capabilities = ["create", "read"]
}

path "sys/wrapping/wrap" {
  capabilities = ["update"]
}

# 允许Terraform访问应用密钥路径，用于生成包装令牌
path "secret/data/app/*" {
  capabilities = ["read"]
}

加载该policy到Vault：

vault policy write terraform-orchestrator terraform-orchestrator-policy.hcl

1.3 创建Terraform专用AppRole #

创建绑定上述policy的role，并设置令牌有效期：

vault write auth/approle/role/terraform-role \
  token_policies="terraform-orchestrator" \
  secret_id_ttl="1h" \
  token_ttl="1h" \
  token_max_ttl="1h"

1.4 获取Terraform认证凭据 #

# 获取Role ID
vault read auth/approle/role/terraform-role/role-id

# 创建并获取Secret ID
vault write -f auth/approle/role/terraform-role/secret-id

将这两个值存入环境变量（如VAULT_ROLE_ID、VAULT_SECRET_ID），禁止硬编码到代码中。

2. Terraform配置：生成响应包装令牌并传递给应用VM #

2.1 配置Vault Provider #

在Terraform代码中添加Vault provider：

provider "vault" {
  address = "http://<VAULT_SERVER_IP>:8200"
  auth_login {
    path = "auth/approle/login"
    parameters = {
      role_id   = var.vault_role_id
      secret_id = var.vault_secret_id
    }
  }
}

2.2 生成响应包装的应用访问令牌 #

先创建应用专用policyapp-secrets-policy.hcl：

path "secret/data/app/prod" {
  capabilities = ["read"]
}

加载policy：

vault policy write app-secrets app-secrets-policy.hcl

在Terraform中生成一次性包装令牌：

resource "vault_wrap" "app_token" {
  target_path = "auth/token/create"
  wrap_ttl    = "15m"
  parameters = {
    policies = ["app-secrets"]
    ttl      = "1h"
  }
}

2.3 将包装令牌传递到应用VM #

通过Terraform远程执行工具，把令牌写入应用VM的指定目录：

resource "null_resource" "deploy_vault_agent" {
  depends_on = [vault_wrap.app_token]

  provisioner "remote-exec" {
    connection {
      type        = "ssh"
      user        = "ubuntu"
      private_key = file("~/.ssh/id_rsa")
      host        = var.app_vm_ip
    }

    inline = [
      "sudo mkdir -p /etc/vault-agent",
      "echo '${vault_wrap.app_token.wrapped_token}' | sudo tee /etc/vault-agent/wrapped-token",
      "sudo chmod 600 /etc/vault-agent/wrapped-token"
    ]
  }
}

3. 应用VM配置：Vault Agent自动解锁并获取密钥 #

3.1 安装Vault Agent #

在应用VM上执行：

sudo apt update && sudo apt install vault -y

3.2 创建Agent配置文件 #

创建/etc/vault-agent/config.hcl：

pid_file = "/var/run/vault-agent.pid"

auto_auth {
  method "token" {
    config = {
      token_file = "/etc/vault-agent/wrapped-token"
      unwrap = true
    }
  }

  sink "file" {
    config = {
      path = "/etc/vault-agent/agent-token"
    }
  }
}

cache {
  use_auto_auth_token = true
}

listener "tcp" {
  address = "127.0.0.1:8200"
  tls_disable = true
}

template {
  source      = "/etc/vault-agent/templates/app-secrets.tpl"
  destination = "/opt/app/secrets.env"
  perms       = "0600"
}

3.3 创建密钥模板文件 #

创建/etc/vault-agent/templates/app-secrets.tpl：

DB_PASSWORD={{ with secret "secret/data/app/prod" }}{{ .Data.data.db_password }}{{ end }}
API_KEY={{ with secret "secret/data/app/prod" }}{{ .Data.data.api_key }}{{ end }}

3.4 启动Vault Agent服务 #

创建systemd服务文件/etc/systemd/system/vault-agent.service：

[Unit]
Description=Vault Agent
Requires=network-online.target
After=network-online.target

[Service]
User=root
Group=root
ExecStart=/usr/bin/vault agent -config=/etc/vault-agent/config.hcl
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

启动并启用服务：

sudo systemctl daemon-reload
sudo systemctl enable --now vault-agent

4. 验证零密钥部署 #

• 检查应用VM上的/opt/app/secrets.env，确认密钥已正确生成
• 确认应用VM无硬编码Vault密钥，所有认证通过包装令牌自动完成
• 查看Vault审计日志，确认包装令牌仅被使用一次（响应包装的一次性特性）

内容的提问来源于stack exchange，提问作者redz1029