HashiCorp Vault — Auto-Auth

Auto-Auth handles automatic authentication to Vault and manages the token lifecycle, including initial login and token renewal.

---

How Auto-Auth Works

1. Agent starts → reads auth credentials (role-id, JWT, etc.)
2. Agent authenticates to Vault → receives a token
3. Agent manages token → renews before expiry
4. If token expires → re-authenticates automatically
5. Token is available → for cache, templates, and sink files

---

Supported Auth Methods

Method	Use Case
approle	CI/CD pipelines, services
aws	EC2 instances, Lambda functions
azure	Azure VMs and services
gcp	GCE instances, GKE pods
kubernetes	Kubernetes pods
jwt	OIDC/JWT token-based auth
cert	TLS client certificate auth
token_file	Pre-existing token on disk

---

AppRole Auto-Auth

# vault-agent.hcl

vault {
  address = "http://127.0.0.1:8200"
}

auto_auth {
  method "approle" {
    config = {
      role_id_file_path   = "/etc/vault/role-id"
      secret_id_file_path = "/etc/vault/secret-id"

      # Remove secret-id file after reading (security)
      remove_secret_id_file_after_reading = true
    }
  }

  # Write token to a file (optional)
  sink "file" {
    config = {
      path = "/etc/vault/agent-token"
      mode = 0640
    }
  }
}

Setup

# 1. Create an AppRole
vault auth enable approle
vault write auth/approle/role/my-app \
    secret_id_ttl=60m \
    token_ttl=1h \
    token_max_ttl=4h \
    policies="my-app-policy"

# 2. Get credentials
vault read -field=role_id auth/approle/role/my-app/role-id > /etc/vault/role-id
vault write -f -field=secret_id auth/approle/role/my-app/secret-id > /etc/vault/secret-id

# 3. Start agent
vault agent -config=/etc/vault/vault-agent.hcl

---

Kubernetes Auto-Auth

auto_auth {
  method "kubernetes" {
    mount_path = "auth/kubernetes"
    config = {
      role = "my-app"
      # Agent automatically finds the SA token
    }
  }

  sink "file" {
    config = {
      path = "/home/vault/.vault-token"
    }
  }
}

---

AWS Auto-Auth

auto_auth {
  method "aws" {
    mount_path = "auth/aws"
    config = {
      type = "iam"
      role = "my-ec2-role"
      # Uses instance metadata or environment credentials
    }
  }

  sink "file" {
    config = {
      path = "/etc/vault/agent-token"
    }
  }
}

---

Token Sink Options

File Sink

sink "file" {
  config = {
    path = "/etc/vault/agent-token"
    mode = 0640
  }
}

Wrapped Token Sink

sink "file" {
  wrap_ttl = "5m"
  config = {
    path = "/etc/vault/wrapped-token"
  }
}

The application must unwrap the token before use — adds a layer of security.

---

Running the Agent

# Foreground (for testing)
vault agent -config=vault-agent.hcl

# Background (production)
vault agent -config=vault-agent.hcl &

# Systemd service
cat <<EOF > /etc/systemd/system/vault-agent.service
[Unit]
Description=Vault Agent
After=network-online.target

[Service]
ExecStart=/usr/bin/vault agent -config=/etc/vault/vault-agent.hcl
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

systemctl enable vault-agent
systemctl start vault-agent

---

Quick Reference

Command	Description
vault agent -config=FILE	Start Vault Agent
vault agent -config=FILE -log-level=debug	Start with debug logging

---

Next: Caching