HashiCorp Vault 기초 — 시크릿 관리와 동적 자격증명

vault server -dev -dev-root-token-id="root"
# 출력된 VAULT_ADDR, Root Token을 메모

# /etc/vault.d/vault.hcl
storage "raft" {
  path    = "/opt/vault/data"
  node_id = "node1"
}
listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_cert_file = "/etc/vault.d/tls/vault.crt"
  tls_key_file  = "/etc/vault.d/tls/vault.key"
}
api_addr = "https://vault.example.com:8200"
ui = true

export VAULT_ADDR='https://vault.example.com:8200'
vault operator init          # unseal 키 5개 + root 토큰 발급 (안전 보관!)
vault operator unseal        # 키 3개를 각각 입력
vault status                 # Sealed: false 확인

export VAULT_ADDR='http://127.0.0.1:8200'
vault login                  # 토큰 입력 (dev면 root)
vault token lookup           # 현재 토큰 정보·TTL·정책 확인

# KV v2 엔진 활성화
vault secrets enable -path=secret kv-v2

# 시크릿 저장
vault kv put secret/myapp/db username="appuser" password="s3cr3t"

# 조회
vault kv get secret/myapp/db
vault kv get -field=password secret/myapp/db    # 값만 추출

# 버전 관리
vault kv get -version=1 secret/myapp/db
vault kv metadata get secret/myapp/db           # 버전 이력

# 소프트 삭제 / 복구 / 완전 삭제
vault kv delete secret/myapp/db
vault kv undelete -versions=2 secret/myapp/db
vault kv destroy -versions=1 secret/myapp/db

# myapp-policy.hcl
# KV v2이므로 실제 경로는 secret/data/...
path "secret/data/myapp/*" {
  capabilities = ["read", "list"]
}
path "secret/metadata/myapp/*" {
  capabilities = ["list", "read"]
}

vault policy write myapp myapp-policy.hcl
vault policy read myapp

# 엔진 활성화
vault secrets enable database

# DB 연결 설정 (Vault가 사용할 관리자 계정)
vault write database/config/postgres \
    plugin_name=postgresql-database-plugin \
    allowed_roles="readonly" \
    connection_url="postgresql://{{username}}:{{password}}@db.example.com:5432/app?sslmode=require" \
    username="vault_admin" \
    password="adminpass"

# 역할 정의: 발급 시 실행할 SQL과 TTL
vault write database/roles/readonly \
    db_name=postgres \
    creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
    default_ttl="1h" \
    max_ttl="24h"

vault read database/creds/readonly
# Key                Value
# lease_id           database/creds/readonly/abc123
# lease_duration     1h
# username           v-token-readonly-x9f2...
# password           A1b2-randomgenerated

vault lease revoke database/creds/readonly/abc123

vault auth enable approle

vault write auth/approle/role/myapp \
    token_policies="myapp" \
    token_ttl=1h token_max_ttl=4h \
    secret_id_ttl=24h

# RoleID(공개) + SecretID(비밀) 발급
vault read auth/approle/role/myapp/role-id
vault write -f auth/approle/role/myapp/secret-id

# 두 값으로 로그인 → 단기 토큰 획득
vault write auth/approle/login \
    role_id="<role_id>" secret_id="<secret_id>"

vault audit enable file file_path=/var/log/vault/audit.log