Spring Boot application - integration with Vault

Description

Vault is a very useful tool to store sensitive data in secure way. To get the data is necessary to pass thorough authentication process. Applications can get credential and certificates to DB, internal and external services,  file storages  etc. In addition Voult can encrypt data which could be store for example in DB (this case won't be checked in this post). 

In our common case we prepare simple application to grab sensitive information. We only put that data to the logger to check solution.

The Solution

Volt

Basic Vault server configuration is described at: https://spring.io/guides/gs/vault-config/. There exists important information such as Java version or path to the sources  (https://www.vaultproject.io/downloads).  It is recommended to add voult's path to the system variables. 

Lets start the Vault server:

vault server --dev --dev-root-token-id="00000000-0000-0000-0000-000000000000"  

Next lets add secrets:

vault kv put secret/artsci-vault-config artsci.username=artsciUser artsci.password=artsciPass

The same result we can see in web browser (http://localhost:8200/). It is necessary to use token we defined at the beginning

(00000000-0000-0000-0000-000000000000)

Then select 'secret' path:

And finally we can see previously created secret element.

 

As You can see everything is correct. You can manage this item. You  can create new version or delete this item.

Spring boot application

I created new application with configuration. Very important is bootstrap.properties file. That configuration is loaded at the beginning.  

 pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">

  <modelVersion>4.0.0</modelVersion>

  <groupId>com.artsci</groupId>

  <artifactId>artsciVoultSpring</artifactId>

  <version>0.0.1-SNAPSHOT</version>

  <name>Voult client </name>

  

  

    <parent>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-parent</artifactId>

        <version>2.2.1.RELEASE</version>

    </parent>

    <dependencies>

        <!-- Vault Starter -->

        <dependency>

            <groupId>org.springframework.cloud</groupId>

            <artifactId>spring-cloud-starter-vault-config</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-test</artifactId>

            <scope>test</scope>

        </dependency>

        

        <dependency>

    <groupId>org.projectlombok</groupId>

    <artifactId>lombok</artifactId>

    <version>1.18.12</version>

    <scope>provided</scope>

</dependency>

<dependency>

    <groupId>org.slf4j</groupId>

    <artifactId>slf4j-simple</artifactId>

    <version>1.8.0-beta4</version>     

</dependency>

        

    </dependencies>

    <dependencyManagement>

        <dependencies>

            <dependency>

                <groupId>org.springframework.cloud</groupId>

                <artifactId>spring-cloud-dependencies</artifactId>

                <version>${spring-cloud.version}</version>

                <type>pom</type>

                <scope>import</scope>

            </dependency>

        </dependencies>

    </dependencyManagement>

    <properties>

        <java.version>1.8</java.version>

        <spring-cloud.version>Greenwich.SR2</spring-cloud.version>

    </properties>

    <build>

        <plugins>

            <plugin>

                <groupId>org.springframework.boot</groupId>

                <artifactId>spring-boot-maven-plugin</artifactId>

            </plugin>

        </plugins>

    </build>

    

    <pluginRepositories>

        <pluginRepository>

            <id>central</id>

            <name>Central Repository</name>

            <url>https://repo.maven.apache.org/maven2</url>

            <layout>default</layout>

            <snapshots>

                <enabled>false</enabled>

            </snapshots>

            <releases>

                <updatePolicy>never</updatePolicy>

            </releases>

        </pluginRepository>

    </pluginRepositories>

    <repositories>

        <repository>

            <id>central</id>

            <name>Central Repository</name>

            <url>https://repo.maven.apache.org/maven2</url>

            <layout>default</layout>

            <snapshots>

                <enabled>false</enabled>

            </snapshots>

        </repository>

    </repositories>

</project>

bootstrap.properties

spring.application.name=artsci-vault-config

spring.cloud.vault.uri=http://localhost:8200

spring.cloud.vault.token=00000000-0000-0000-0000-000000000000

spring.cloud.vault.scheme=http

spring.cloud.vault.kv.enabled=true

VoltVariables .class

package artsciVoultSpring;

import org.springframework.boot.context.properties.ConfigurationProperties;

import lombok.Data;

@ConfigurationProperties("artsci")

@Data

public class VoltVariables {

private String username;

private String password;

}

ArtsciSpringVoultApp 

package artsciVoultSpring;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.boot.CommandLineRunner;

import org.springframework.boot.SpringApplication;

import org.springframework.boot.autoconfigure.SpringBootApplication;

import org.springframework.boot.context.properties.EnableConfigurationProperties;

@SpringBootApplication

@EnableConfigurationProperties(VoltVariables.class)

public class ArtsciSpringVoultApp implements CommandLineRunner  {

private final VoltVariables voltVariables;

public ArtsciSpringVoultApp (VoltVariables voltVariables) {

this.voltVariables = voltVariables;

}

public static void main(String[] args) {

SpringApplication.run(ArtsciSpringVoultApp.class, args);

}

public void run(String... args) {

    Logger logger = LoggerFactory.getLogger(ArtsciSpringVoultApp.class);

    logger.info("----------------------------------------");

    logger.info("Configuration properties");

    logger.info("Username: {}", voltVariables.getUsername());

    logger.info("Password: {}", voltVariables.getPassword());     

    logger.info("----------------------------------------");

  }

}

The Results

At the end we can compare properties in Voult and in application logs

So everything looks good. Variables are exactly the same :)

AWS - how to create admin user?

AWS

Objectives

Today I'm going to describe how to create a new admin user in the biggest cloud platform - AWS. AWS currently contains 212 available services which can be used to build complete environment. Admin user is necessary to manage all environments and services but that role is also limited and there is no default permission to some high level services like i.e. billing 

Admin user

At the beginning let's find IAM (Identity and Access Management) service and create new group.

Press button "Create new group"

Type your group name

Select appropriate policy

And finally create new group

So, the Administrators group has just been created. Let's create "admin" user and add it to previously created group.  

Press button "Add user"

Type user name and select access types

Select group with permissions 

Add tags

User is almost created 

That's it. User is active and access key is generated 

Amazon CLI - Command Line Interface

CLI is very useful tool which could be used by administrators or ansible playbooks to create infrastructure on AWS.

Let's try it. Documentation is hire: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html

After download and install we can check it.

aws configure
AWS Access Key ID [None]: [access key]
AWS Secret Access Key [None]: [secret key]
Default region name [None]: eu-central-1
Default output format [None]: UTF-8

Base on configuration we can create KeyPair for testing

aws ec2 create-key-pair --key-name ArtsciKeyPair --query 'KeyMaterial' --output text > ArtsciKeyPair.pem

And using AWS console we can observe the results :)