HashiCorp Vault and Jenkins - Leveraging AWS IAM to Empower a Hybrid Scenario
summary
Built a Fargate container called Trust Manager that uses an IAM role, S3-stored Ansible inventory and the Vault AWS auth method to create AppRoles per Bitbucket project and inject short-lived AppRole credentials into Jenkins controller-level credentials every hour. A Jenkins shared library calls the Vault plugin to swap those creds for AWS provisioning roles, eliminating personal tokens, provisioning via Terraform, logging to CloudWatch and Splunk, and delivering auditable usage dashboards — deployed and working in production.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 2:53Ecosystem overview
- 4:51Vault implementation
- 7:17Solving the secret zero challenge
- 10:51Automating credential injection
- 14:57Governance and shared library
- 19:31Authentication flow
- 22:19Provisioning and monitoring
- 25:43Conclusion and takeaways
related talks
25mSecure Your Terraform Deploys in GitLab-CI with HashiCorp Vault
25mIntegrating Vault with CI/CD pipelines: Best practices and pitfalls
31mSecure Your Multi-Cloud Delivery Pipeline with HashiCorp Vault
22mSecuring AWS Accounts With HashiCorp Vault
38mDon’t Break Your Pasta! Good Practices for Securing Your Pipelines
38mKeeping Secrets - A Practical Approach to Managing Credentials
28mSecret Management with Hashicorp´s Vault
46mVault configuration as code via HashiCorp Terraform - Stories from trenches