September 2024 Summaries

Cyber criminals are increasingly targeting collaboration platforms to discover useful information like user credentials, which can make breaches appear legitimate. To safeguard against this, organizations should adopt secret scanning tools and integrate them into their developer workflow. HCP Vault Radar is a secrets scanning and remediation product that supports automated scans for unmanaged secrets in collaboration platforms such as JIRA, Confluence, and Slack. It also prioritizes findings effectively for developer and operations teams to quickly diagnose the severity of issues and take immediate remediation actions if needed.

This blog post discusses the use of HashiCorp Vault namespaces for multi-tenant deployments, drawing on practical solutions engineering experience. It explains when namespaces are appropriate and inappropriate to use, provides real-world examples, and shares insights gained from tackling multiple use cases. The text also explores various approaches to structuring Vault namespaces, such as by geographical region, data sensitivity levels, business unit, and application ID. Finally, it offers guidance on moving to a new structure, addressing namespace limits, and testing different options.

HashiCorp has introduced run queue visibility for HCP Terraform and new ephemeral workspace features for both HCP Terraform and Terraform Enterprise. These enhancements aim to simplify IT operations, increase developer velocity, and reduce costs for organizations. The run queue visibility feature provides platform teams with the tools to see the activity of all runs in an organization, while project-scoped ephemeral workspaces enable automatic destruction of resources to reduce cloud costs. Additionally, the latest TFE provider allows users to manage auto-destroy time-to-live settings on workspaces.

This blog post discusses how to configure HashiCorp Vault as an identity provider (IdP) for your applications, allowing businesses and their customers to delegate user authentication implementation to a specialist platform like Vault. It explains the OpenID Connect (OIDC) workflow and how Vault can act as an OIDC provider, enabling secrets management and identity servers through one platform. The post also provides step-by-step instructions on configuring Vault as an OIDC provider and building an application as a relying party, including user registration and authentication processes.

Google Distributed Cloud (GDC) has integrated with HashiCorp Vault Enterprise to enhance security and developer productivity in regulated industries. The integration allows users to centrally store, access, and deploy secrets across applications, systems, and infrastructure while maintaining strict regulatory requirements. GDC customers can now access Vault through the GDC air-gapped marketplace starting with the 1.14 release. HashiCorp Vault is a platform for centralized secrets management, encryption as a service, and identity-based access, helping companies manage their infrastructure security.

Secrets are crucial in securing access to applications, sensitive data, or machines. They fall into four categories: unmanaged, static, rotated, and dynamic. Static secrets are the most common type but pose security risks if not securely stored and centrally managed. Rotating and dynamically generating secrets can improve an organization's security posture by reducing the time a secret could be used if obtained by a threat actor. Auto-rotated secrets enable organizations to improve their security stance by ensuring that static secrets aren't long-lived. They are created on a schedule, with one or multiple new versions stored as the latest version(s) for the secret. When an instance of the application starts up, it will pull the latest version of the secret. Dynamic secrets help manage intentions instead of managing credentials and are created just-in-time by an issuing service when requested. They have a predefined lifespan (TTL), after which they expire and become invalid. Every application instance has a different credential, and each set of credentials can be revoked irrespective of other running applications. Auto-rotated secrets are suited for longer-lasting workloads that need more stability in their connection but still need to be rotated. Dynamic secrets are particularly useful for ephemeral workloads in environments with stringent security requirements, such as cloud environments, distributed systems, and microservice architectures. Incorporating both dynamic secrets and secret auto-rotation into an organization's secrets management practices can effectively address a broader range of security requirements and operational challenges.

In April, HashiCorp launched its new Madrid Tech Hub and selected Julia Friedman and Will Farley as part of the Madrid Founders Program to help build and support the location. Both have shared their personal experiences adapting to life in Madrid, highlighting the emotional and practical challenges of adjusting to a new cultural environment. They've discussed their favorite places to visit, local customs they've enjoyed, and how they've adjusted to the Spanish lifestyle. The Madrid Tech Hub is focused on enablement and ensuring the team has the right skills for success. Both Julia and Will are excited about the opportunities ahead and look forward to seeing the growth of the team in the coming months.

The article explores how to efficiently manage SSL certificates in Spring Boot applications by leveraging HashiCorp Vault's PKI secrets engine and Vault Agent for SSL hot reload. It outlines a method to automate certificate renewal without restarting the application, maintaining code independence from Vault. The process involves setting up a PKI secrets engine in Vault to generate dynamic X.509 certificates, deploying Vault Agent to handle authentication and write secrets to files, and configuring Spring Boot to reference these files for SSL hot reloads. This approach helps handle certificate expiration dynamically, avoiding manual configurations and downtime, and the article provides a detailed example of this implementation. Additional resources and tutorials for integrating HashiCorp Vault with Spring applications are also referenced.

This tutorial demonstrates how to use GitHub Actions to automate HCP Terraform operations for AWS infrastructure deployment. It covers setting up a GitHub Actions workflow that interacts with HCP Terraform, ensuring secure management of credentials and efficient collaboration among team members. The integration of these platforms provides a powerful automated pipeline for deploying and managing AWS infrastructure while minimizing manual errors and ensuring consistency across environments.

Nine new HashiCorp Vault ecosystem integrations have been announced, extending security use cases for customers. These include HCP Vault Dedicated integration from Real-Time Innovations (RTI), HCP Vault Radar integration from GitHub, and five new Vault Enterprise integrations with partners such as Dell, Keyrunner, Mindflow, Rubrik, and Veza. Additionally, two new HashiCorp Vault Community Edition integrations have been released with Fortinet and walt.id. These partnerships strengthen customer security by providing a solid foundation for companies to protect, connect, and inspect infrastructure, applications, and data in multi-cloud environments.

The US National Institute of Standards and Technology (NIST) has published three recommended cryptographic standards for post-quantum secure cryptography to address the threats posed by quantum computers. These recommendations empower companies, technology providers, and users to adopt new encryption methodologies to help communications and data exchange remain secure when quantum computers become available at scale. The immediate enterprise risk concerns the security of long-lived sensitive business data, which bad actors are already seeking to extract using a harvest-now-decrypt-later strategy. To mitigate this risk, enterprises should enforce zero trust security policies and practices. Enterprises should also begin experimenting with available post-quantum cryptography (PQC) implementations to assess potential changes needed to ensure that the existing systems can function across existing and quantum-based cryptography.

This tutorial demonstrates how to securely access AWS from HCP Terraform using OIDC federation, eliminating the need for access keys. By setting up an OIDC provider and dynamic provider credentials, users can authenticate with IAM roles and obtain temporary security credentials for each run. The process involves creating an OIDC provider, setting up an example IAM role, and using environment variables to enable HCP Terraform to assume the IAM role at runtime. Additionally, implementing access management for your AWS organization is recommended for improved security and scalability.

HashiCorp has expanded its Infrastructure Lifecycle Management ecosystem by introducing 18 new Terraform and Packer integrations from 16 partners. These integrations provide additional capabilities to users of HCP Terraform, Terraform Enterprise, and Community Edition as they manage their cloud and on-premises infrastructure. The HashiCorp Terraform Registry now includes these new integrations, which include providers for Astronomer.io, Authsignal, Catchpoint, Files.com, Illumio, incident.io, JetBrains, Juniper Networks, Palo Alto Networks, Render, SkySQL, Solace, Styra, and Tessell. Additionally, HCP Packer has two new integrations with GitHub and GitLab to tie Packer pipeline metadata with their respective pipelines.