April 2025 Summaries

HCP Vault Radar is now generally available, enabling organizations to discover and prioritize unmanaged secrets in collaboration platforms and Git-supported repositories directly into HashiCorp Vault for centralized management. This tool helps reduce the risk associated with secret sprawl by detecting unmanaged and leaked secrets, as well as those that have been hard coded or reside in plaintext, so they can take appropriate actions to remediate these vulnerabilities. It uses advanced detection algorithms to identify hardcoded secrets in source code, configuration files, collaboration platforms, and other assets, integrating seamlessly with version control systems like Git, scanning current code repositories and new code submissions to provide real-time alerts and block commits containing sensitive information. HCP Vault Radar supports a wide range of data sources, including cloud-based, on-premises, and hybrid environments, and provides guided remediation workflows, incident management tools integrations, and the ability to prioritize risks effectively by evaluating factors such as version history analysis and activeness checks. The tool also enables organizations to prevent exposed secrets from entering their codebase by utilizing pre-receive and pre-commit webhooks, ensuring that no secrets make it into the codebase.

Terraform now supports multiple team tokens, allowing teams in HashiCorp's HCP Terraform to generate distinct API tokens for better access control and collaboration within Terraform environments. This enhancement simplifies permissions management and enables the least privilege principle in infrastructure workflows. Previously, only a single team API token per team was allowed, which presented challenges in terms of security, access control, and auditing. With multiple team tokens available, organizations can create granular access to projects and workspaces, reducing operational risk when users leave the organization. This new capability is now generally available in HCP Terraform and coming soon to Terraform Enterprise.

The CA/Browser forum has voted to amend the TLS Baseline Requirements, setting a schedule for shortening both the lifetime of TLS certificates and the reusability of CA-validated information in certificates. The new certificate validity lifespan is 47 days by March 15, 2029. This change requires organizations to prioritize automation of certificate lifecycle management processes to ensure operational uptime, availability, and better security. HashiCorp Vault can help mitigate these risks by automating the entire process, reducing the risk of outages and manual errors. It offers a central source of truth, automatic certificate generation, and automatic certificate renewals, taking the complexity out of managing internal certificates while ensuring adequate security and operational scale. By adopting Vault, enterprises can address this new challenge with ease and renewed confidence.

Cybersecurity remains top-of-mind for organizations, and aligning their strategy with acceptable risk is crucial. Determining what constitutes acceptable risk involves weighing the cost of risk mitigation against the potential impact of threats to the organization. This requires a comprehensive understanding of threats, vulnerabilities, and context, as well as prioritizing risks based on likelihood and impact. Organizations can use a multi-step process to catalog threats, prioritize them, and allocate resources to lower risk. To strengthen cloud security and governance, many organizations are moving to a unified approach for infrastructure and security lifecycle management, which removes complexity and reduces risk by empowering effective countermeasures for common threats such as cloud misconfigurations and unauthorized data access.

The AWS and AWSCC Terraform providers are two separate providers that interact with AWS APIs, but they complement each other rather than competing. The AWS provider is built on the AWS SDK and has been around for 10 years, with over three billion downloads, offering a wide range of resources for various AWS services. It's handwritten in Go, ensuring rigorous test coverage but also making it challenging to support all AWS resources, especially day-one support for new services. In contrast, the AWSCC provider is automatically generated from the Cloud Control API and provides launch-day support for new AWS services or features. The AWSCC provider offers a uniform interface, allowing new resources to be automatically generated based on codified rules as soon as new resource schemas are released. Using both providers together equips developers with a large catalog of resources across established and new AWS services. Migrating state between the two providers can be done by refactoring existing code, importing necessary modules, removing old providers, and creating new ones. The article provides examples and best practices for using both providers, as well as resources for further learning.

HashiCorp has released Nomad 1.10, a new version of its simple and flexible orchestrator for deploying and managing containers and non-containerized applications across multiple environments. The new release introduces several key features, including dynamic host volumes, extended OIDC support with signed client assertions and Proof Key Code Exchange (PKCE), improved CLI to UI transition, expanded upgrade testing, and more. Dynamic host volumes provide a flexible way to provision storage across Nomad client infrastructure, while the enhanced OIDC support enhances security for clients in finance and government industries. The release also includes improved CLI to UI transition, expanded upgrade testing, and various other enhancements. Users can download Nomad 1.10 from the project website and try out its new features, or contribute to the project by submitting a pull request on GitHub.

This demo showcases how HashiCorp Vault's transit secrets engine can be used to protect sensitive data before sending it to an Amazon Bedrock Knowledge Base created by Terraform. The process involves encrypting the names of hosts using convergent encryption, which ensures that a plaintext host name results in the same ciphertext. This allows the LLM to analyze each rental listing for similarities between hosts without knowing the actual host name. The demo uses an HCP Vault cluster with the transit secrets engine enabled and demonstrates how to create a data source from S3, configure a vector store using Amazon OpenSearch Serverless, and set up an Amazon Bedrock Knowledge Base for the S3 bucket with rental listings. The knowledge base requires sufficient IAM access to the S3 bucket, OpenSearch collection, and embedding model. It also defines field mappings defined in the OpenSearch index for the vector embeddings. By encrypting sensitive data before augmenting a LLM with RAG, you can protect access to the data and prevent leakage of sensitive information. Vault offers additional advanced data protection techniques such as format-preserving encryption, masking, and data tokenization using the transform secrets engine.