HashiCorp Vault — Control Groups & MFA

Control Groups add approval workflows for sensitive operations, and MFA adds multi-factor authentication for step-up security.

---

Control Groups (Enterprise)

Control Groups require one or more authorizers to approve a request before it is executed — like a two-person rule for nuclear launch codes.

How It Works

1. User requests access to sensitive secret
2. Vault returns an "access denied" with a request ID
3. Request goes to authorizer(s) for approval
4. Authorizer approves the request
5. User retries with the approval token
6. Vault serves the secret

---

Configure Control Groups

# Policy with control group
path "secret/data/production/db-master" {
  capabilities = ["read"]

  control_group {
    factor "authorizer" {
      identity {
        group_names = ["security-team"]
        approvals   = 1
      }
    }

    ttl = "4h"  # How long the approval request stays valid
  }
}

Workflow

# Step 1: User tries to read the secret
vault kv get secret/production/db-master
# Error: request needs approval
# Accessor: abc123...

# Step 2: Authorizer checks pending requests
vault list sys/control-group/request

# Step 3: Authorizer approves
vault write sys/control-group/authorize accessor=abc123

# Step 4: User retries with the wrapping token
vault unwrap <wrapping-token>
# Secret is revealed

---

MFA (Multi-Factor Authentication)

Login MFA (OSS + Enterprise)

Require MFA during login:

# Enable TOTP MFA
vault write sys/mfa/method/totp/my-totp \
    issuer=Vault \
    period=30 \
    key_size=20 \
    algorithm=SHA1 \
    digits=6

# Associate with auth method
vault write sys/mfa/method/totp/my-totp/admin-generate \
    method_id=totp-method-id

Step-Up MFA (Enterprise)

Require additional MFA for sensitive paths:

# Policy with MFA requirement
path "secret/data/production/*" {
  capabilities = ["read"]

  mfa_methods = ["totp"]
}

---

MFA Methods

Method	Description
TOTP	Time-based one-time passwords (Google Authenticator)
Okta	Okta push notifications
Duo	Duo Security push
PingID	PingID push

---

TOTP MFA Setup

# 1. Enable TOTP MFA method
vault write sys/mfa/method/totp/my-totp \
    issuer="Vault" \
    period=30

# 2. Generate a TOTP secret for a user
vault write sys/mfa/method/totp/my-totp/generate \
    entity_id=<user-entity-id>
# Returns: barcode URL for QR code scanning

# 3. Login with MFA
vault login -method=userpass username=admin password=pass \
    -mfa "my-totp:123456"

---

Quick Reference

Feature	OSS	Enterprise	Use Case
Login MFA	✅	✅	Enforce MFA at authentication
Step-up MFA	❌	✅	MFA for specific paths
Control Groups	❌	✅	Approval workflows

---

Next: Response Wrapping