May 2024 Summaries

The Terraform AWS Cloud Control provider, built around the AWS Cloud Control API and designed to bring new services to HashiCorp Terraform faster, is now generally available. This 1.0 release of the AWSCC provider represents another step forward in offering launch day support of AWS services. The AWSCC provider gives developers access with several new AWS services such as: AWS Billing Conductor, AWS Chatbot, Amazon Personalize, Amazon Q Business, and more. With its ability to automatically support new features and services, this AWSCC provider will increase the resource coverage and significantly reduce the time it takes to support new capabilities.

Organizations adopting cloud infrastructure and applications face increased security risks, necessitating a new approach to Security Lifecycle Management (SLM). SLM involves managing sensitive data from creation to expiration using zero-trust, identity-based access architecture. To protect their environments, organizations need a central system of record for secrets, employing secrets rotation and dynamic secrets to mitigate risks associated with long-lived credentials. Proper inspection of environments is crucial to identify unsecured sensitive data, while enforcing least-privilege access based on trusted identities across the organization is a critical best practice. HashiCorp offers a portfolio of products managed on HCP that help with different aspects of security strategy, including Vault for brokering trusted identities and automating access to secrets, Boundary for modern privileged access management, and Consul for identity-based service networking. By leveraging these offerings, organizations can trust that their most sensitive data is protected throughout the lifecycle.

HashiCorp has released version 1.8 of its orchestrator, Nomad, which introduces several new features including an exec2 driver, a refreshed UI for the jobs index page, Consul API gateway and transparent proxy support, among others. The update also marks the beginning of a Long-Term Support (LTS) release program for HashiCorp Nomad Enterprise. LTS releases aim to reduce operational overhead and risk by allowing organizations to receive critical fixes in minor releases without having to upgrade their major version more than once a year.

Infrastructure Lifecycle Management (ILM) is a modern approach to managing infrastructure across different cloud environments and providers. It involves building, deploying, and maintaining the underlying infrastructure that supports cloud applications. Effective ILM requires a systematic and repeatable approach using tools like Infrastructure as Code (IaC), policy enforcement through guardrails, and regular health assessments of infrastructure. HashiCorp offers a portfolio of products managed on its HCP platform to enable unified workflows for different aspects of infrastructure and application deployment, including Terraform, Packer, Waypoint, and Nomad. These tools help organizations deliver fast, secure, and cost-efficient cloud infrastructure from start to finish.

Vagrant Cloud has been migrated to the HashiCorp Cloud Platform (HCP) under the new name of HCP Vagrant Registry. Existing users can now move their Vagrant boxes to HCP, which offers a fully managed platform for HashiCorp products as a service. The transition brings improvements such as enhanced box search capabilities and an updated user interface for better navigation and artifact management. HCP organizations can have up to ten projects, with each organization assigned a default project at creation. HashiCorp will host all boxes in the HCP Vagrant Registry without charge, allowing users to have an unlimited number of private and public boxes.

IoT devices are becoming increasingly popular, with McKinsey & Company estimating that they will drive up to $12.6 trillion in economic value by 2030. However, the growth of IoT also brings new security challenges that need to be addressed. PKI is an essential component for securing an organization's IoT infrastructure, and EST is a popular protocol to facilitate automation and management of different devices. PKI supports various protocols, including ACME, SCEP, and EST, which are crucial for managing large volumes of certificates in IoT use cases. Automating the provisioning and rotation of PKI certificates on diverse devices helps reduce risk and allows IT teams to manage their PKI at scale. HashiCorp Vault supports PKI and certificate automation to secure diverse infrastructures, with EST now available as a beta feature for enhanced security and efficiency.

In April, HashiCorp introduced its new custom font, HashiCorp Sans, as part of a brand evolution effort. The company worked with XYZ Type to develop the distinctive display typeface available in Light, Regular, Medium, and Semibold. Four key characteristics make HashiCorp Sans unique: accentuated bridges and slabs for horizontal flow, developer-inspired letterform details, ink traps for movement and illumination, and a humanist quality for an organic feel. The font is now used across all corporate and product logos and headlines.

Global Accessibility Awareness Day (GAAD) on 16 May aims to raise awareness of the lack of accessibility in the tech space and challenges faced by people with disabilities. The day encourages everyone to analyze their assumptions, challenge them, and meet people with disabilities with an open mind. Inclusive Access Alliance, a disability-led ERG at HashiCorp, promotes inclusivity and accessibility in the workplace. GAAD highlights the importance of involving disabled individuals in the development of assistive technologies and emphasizes the motto "Nothing about us without us."

This blog post discusses leveraging HashiCorp Vault as a trusted Certificate Authority (CA) to issue short-lived code signing certificates for a GitHub Actions workflow that signs PowerShell scripts using Microsoft Authenticode. The solution uses a two-tier public key infrastructure (PKI), with OpenSSL operating the root CA and Vault operating the code signing issuing CA. The process involves generating an Elliptic Curve P-521 key pair, issuing a self-signed root certificate, provisioning resources in Vault using HashiCorp Terraform module, and having the root CA issue a certificate for Vault's code signing CA. The sample GitHub workflow provided can be used to test this code signing pipeline concept. This approach offers benefits such as automating PKI management, reducing manual verification processes, and ensuring internal software distribution security.

The final installment of a blog series explores automating the unsealing and snapshotting of HashiCorp Vault using HashiCorp Nomad and a tool called Vault Unsealer. This series previously covered deploying infrastructure and running Vault as a Nomad job, and now it delves into automating operational tasks such as unsealing Vault servers and taking data snapshots. Vault Unsealer automates the unsealing process by using unseal keys and the Vault API, which is particularly useful for organizations that cannot use auto-unseal due to security policies or costs. The blog also outlines how to configure a Nomad job to take regular backups of Vault data, using Terraform for deployment and workload identity for authentication. The series highlights the benefits of running Vault on Nomad, offering a streamlined approach to managing Vault servers, and suggests that smaller organizations with limited resources might benefit from this setup. Additionally, it touches on the potential of using HashiCorp Vault as a certificate authority within GitHub Actions workflows and the importance of security automation in building reliable infrastructure.

HashiCorp has announced that its Terraform Enterprise is now fully supported for deployment on Podman with Red Hat Enterprise Linux 8 and above. This update provides an end-to-end supported option for running Terraform Enterprise on RHEL, allowing organizations to continue leveraging their preferred platform with a fully supported upgrade path. The latest release also includes improvements in VCS, policy, and run task workflows at scale.

Golden patterns for infrastructure and security automation workflows lie at the core of The Infrastructure Cloud. Using HashiCorp Cloud Platform (HCP) services, this post illustrates how to implement these golden patterns in a secure provisioning workflow that addresses challenges related to remote infrastructure access and credential/secrets management in cloud environments. This workflow can be applied across various cloud providers and hybrid cloud environments. The example scenario involves deploying an application to a Linux-based virtual machine (VM) running in Azure, with the app needing to access a sensitive text string for execution. By leveraging HashiCorp Terraform, Vault, and Boundary, this golden path workflow automates solutions to these challenges while ensuring secure management of infrastructure and security lifecycles.

This blog post demonstrates how to deploy a 3-node HashiCorp Vault cluster as a HashiCorp Nomad job and automate the cluster initialization. It covers creating namespaces for isolation, configuring Terraform remote state data source, writing a Nomad job with specifications at the job, group, and task layers, using retry_join stanzas to join the Vault cluster, initializing and unsealing Vault, and storing unseal keys and root token as Nomad variables. The post also provides an overview of HashiCorp's Infrastructure Cloud and HCP Vault Radar for securing secrets in code repositories and other tools.

Cloud waste is a significant issue, with 94% of respondents to the 2023 HashiCorp State of Cloud Strategy Survey experiencing avoidable cloud costs. The most common sources of cloud waste are overprovisioning, idle resources, and lack of tracking. To mitigate these issues, HashiCorp Terraform offers seven capabilities: modules for standardizing configurations; no-code provisioning for simplified workflows; policy as code frameworks for automating approval criteria; run tasks for integrating with third-party cost optimization products; drift detection and health assessments for monitoring infrastructure changes; continuous validation for ongoing checks on infrastructure; and ephemeral workspaces for automating the destruction of temporary resources. These features help organizations reduce cloud waste, manage costs, enforce policies, and increase productivity throughout the cloud adoption process.

Boundary 0.16 release enhances user experience and governance by introducing aliases, flexible storage options with MinIO, and improved search capabilities. Aliases simplify target connection by allowing custom resource names, while the addition of MinIO as a backend storage option for session recordings provides an alternative to Amazon S3. The new admin UI search functionality supports various resources and includes support for pagination. These updates aim to improve security, meet compliance requirements, and address modern privileged access management needs.

The text discusses the use of workload identity federation as an alternative to storing service account keys for secure access to Google Cloud from HCP Terraform. Workload identity federation uses IAM to grant external identities, such as HCP Terraform, the ability to impersonate service accounts. This method eliminates the need to store long-lived service account keys in HCP Terraform, which poses a significant security risk if compromised. The text provides an example of how to configure workload identity federation in Google Cloud and shares the benefits of using this approach for improved security and scalability within HCP Terraform workspaces.