HashiCorp Vault — Kubernetes & AWS Auth

2 minute read

Kubernetes and AWS auth methods allow workloads to authenticate to Vault using their cloud-native identity — no secrets to distribute.

Kubernetes Auth

Kubernetes auth validates a pod’s Service Account JWT against the Kubernetes API server.

┌──────────────┐     ┌──────────────┐     ┌──────────┐
│  K8s Pod     │     │    Vault     │     │ K8s API  │
│              │     │              │     │ Server   │
│ ① Send SA   │     │              │     │          │
│   JWT token  │────▶│ ② Validate  │────▶│ ③ Verify │
│              │     │    JWT       │◀────│   JWT    │
│              │◀────│ ④ Return    │     │          │
│  ⑤ Use      │     │   Vault     │     │          │
│  Vault token │     │   token     │     │          │
└──────────────┘     └──────────────┘     └──────────┘

Enable Kubernetes Auth

vault auth enable kubernetes

Configure

# If Vault runs outside the K8s cluster
vault write auth/kubernetes/config \
    kubernetes_host="https://kubernetes.default.svc:443" \
    token_reviewer_jwt="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
    kubernetes_ca_cert="$(cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt)"

# If Vault runs inside the K8s cluster (auto-detect)
vault write auth/kubernetes/config \
    kubernetes_host="https://kubernetes.default.svc:443"

Create a Role

# Create a role that maps K8s service accounts to Vault policies
vault write auth/kubernetes/role/webapp \
    bound_service_account_names="webapp-sa" \
    bound_service_account_namespaces="production" \
    policies="webapp-policy" \
    token_ttl=1h \
    token_max_ttl=4h

Authenticate from a Pod

# Inside a K8s pod
JWT=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)

# Login via API
curl -s --request POST \
     --data "{\"jwt\": \"$JWT\", \"role\": \"webapp\"}" \
     "$VAULT_ADDR/v1/auth/kubernetes/login" | jq

Restrict by Namespace and Service Account

# Only pods in "production" namespace with "webapp-sa" service account
vault write auth/kubernetes/role/webapp \
    bound_service_account_names="webapp-sa" \
    bound_service_account_namespaces="production" \
    policies="webapp-prod-policy"

# Allow multiple namespaces
vault write auth/kubernetes/role/monitoring \
    bound_service_account_names="prometheus-sa" \
    bound_service_account_namespaces="monitoring,observability" \
    policies="monitoring-policy"

# Wildcard (any service account in a namespace)
vault write auth/kubernetes/role/dev-all \
    bound_service_account_names="*" \
    bound_service_account_namespaces="development" \
    policies="dev-read-only"

AWS Auth

AWS auth validates identity using IAM roles, instance profiles, or Lambda execution roles.

Two Sub-Methods

Method How It Works Best For
IAM Signs an STS request with AWS credentials EC2, ECS, Lambda, any AWS workload
EC2 Uses EC2 instance identity document EC2 instances only

Enable AWS Auth

vault auth enable aws

Configure (IAM Method)

# Configure Vault's AWS credentials (for STS verification)
vault write auth/aws/config/client \
    access_key="AKIAIOSFODNN7EXAMPLE" \
    secret_key="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

# Or use an IAM role (preferred in production)
# Vault's own IAM role needs sts:GetCallerIdentity permission

Create IAM Role

# Allow EC2 instances with a specific IAM role to authenticate
vault write auth/aws/role/webapp \
    auth_type="iam" \
    bound_iam_principal_arn="arn:aws:iam::123456789012:role/webapp-role" \
    policies="webapp-policy" \
    token_ttl=1h

# Allow any role in an account
vault write auth/aws/role/any-role \
    auth_type="iam" \
    bound_iam_principal_arn="arn:aws:iam::123456789012:*" \
    policies="basic-read"

Login from AWS (IAM Method)

# From an EC2 instance or ECS task with an IAM role
vault login -method=aws role=webapp

# API equivalent (more common in applications)
# The app must generate an STS request signature

EC2 Method

vault write auth/aws/role/ec2-webapp \
    auth_type="ec2" \
    bound_ami_id="ami-0abc123" \
    bound_vpc_id="vpc-12345" \
    bound_subnet_id="subnet-67890" \
    bound_iam_instance_profile_arn="arn:aws:iam::123456789012:instance-profile/webapp" \
    policies="webapp-policy" \
    token_ttl=1h

Cloud Auth Comparison

Feature Kubernetes AWS IAM AWS EC2
Identity source Service Account JWT IAM credentials Instance identity document
Binding options SA name, namespace IAM principal ARN AMI, VPC, subnet, instance profile
Rotation needed No (JWT auto-rotated) No (uses STS) No (uses PKCS7 signature)
Best for K8s pods Any AWS workload EC2 instances

Quick Reference

Command Description
vault auth enable kubernetes Enable K8s auth
vault write auth/kubernetes/config ... Configure K8s
vault write auth/kubernetes/role/NAME ... Create K8s role
vault auth enable aws Enable AWS auth
vault write auth/aws/config/client ... Configure AWS
vault write auth/aws/role/NAME auth_type=iam ... Create IAM role
vault login -method=aws role=NAME AWS login

Next: Practice Exercises

You may also enjoy