Skip to content

Integrating SailPoint with HashiCorp Vault Integration (Cloud)

Use the HashiCorp Vault Integration (Cloud) connector to discover and aggregate non-human identities (NHIs) from HCP Vault Dedicated into SailPoint. The connector supports HCP Vault Dedicated Essentials and Standard tiers.

The connector authenticates to one Vault namespace through AppRole and aggregates metadata for the following NHI types:

  • Agents and machines
  • Service accounts
  • Personal access tokens (PATs) and tokens
  • Secrets
  • API keys

The connector provides read-only discovery. It does not retrieve secret values.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

Feature Description
Test connection Validates the connection to HashiCorp Community Vault.
Dataset aggregation Aggregates HashiCorp configuration and metadata into the datasets.

Non-Human Identity Discovery

  • Aggregate Vault agents and machines, service accounts, tokens and PATs, secrets, and API keys

Refer to Dataset Management for more information.

Refer to Discovering Potential Non-Human Accounts for more information.

Supported Platform

The connector supports HCP Vault Dedicated Essentials and Standard tiers.

Prerequisites

Before you configure the HashiCorp Vault Integration (Cloud) source for HCP Vault Dedicated Essentials or Standard, prepare the target Vault namespace and AppRole.

  • Use an HTTPS Vault cluster URL with a valid certificate.
  • Use a Vault account that can create a policy and AppRole in the target namespace.

Important

Create the policy and AppRole in the target namespace. The connector accesses one namespace and reads metadata only.

Creating the Vault ACL Policy

  1. Save the required policy rules in a file named sail-connector.hcl.

    path "sys/health"                 { capabilities = ["read"] }
path "sys/auth"                   { capabilities = ["read", "list"] }
path "sys/mounts"                 { capabilities = ["read", "list"] }
path "sys/wrapping/lookup"        { capabilities = ["update"] }
path "sys/wrapping/unwrap"        { capabilities = ["update"] }
path "auth/token/renew-self"      { capabilities = ["update"] }

  2. Add the following rules for the NHI types that you want the connector to discover.

    # Agents and machines (AppRole) and service accounts (Kubernetes)
path "auth/+/role"                { capabilities = ["list"] }
path "auth/+/role/*"              { capabilities = ["read"] }
path "identity/lookup/entity"     { capabilities = ["update"] }
path "identity/entity/id"         { capabilities = ["list"] }
path "identity/entity/id/*"       { capabilities = ["read"] }
path "identity/group/id/*"        { capabilities = ["read"] }

# Tokens
path "auth/token/accessors"       { capabilities = ["list"] }
path "auth/token/lookup-accessor" { capabilities = ["update"] }

# API keys (dynamic credentials; database engine shown)
path "database/roles"             { capabilities = ["list"] }
path "database/roles/*"           { capabilities = ["read"] }
path "database/static-roles"      { capabilities = ["list"] }
path "database/static-roles/*"    { capabilities = ["read"] }
path "sys/policies/acl"           { capabilities = ["list"] }
path "sys/policies/acl/*"         { capabilities = ["read"] }

# Secrets (KV v2 metadata only)
path "+/metadata"                 { capabilities = ["list"] }
path "+/metadata/*"               { capabilities = ["list", "read"] }

    Warning

    Do not grant access to KV v2 data/* paths. The connector requires metadata access only.

  3. Write the policy to the target namespace.

    vault policy write -namespace=<target> <policy-name> sail-connector.hcl

Creating the AppRole Credentials

  1. Create an AppRole role that uses the policy.

    vault write -namespace=<target> auth/approle/role/<role-name> \
    token_policies=<policy-name> \
    token_ttl="1h" \
    token_max_ttl="4h" \
    secret_id_ttl="0" \
    secret_id_num_uses=0

  2. Read and securely store the Role ID.

    vault read -namespace=<target> auth/approle/role/<role-name>/role-id

  3. Generate a Secret ID.

    vault write -namespace=<target> -f auth/approle/role/<role-name>/secret-id

  4. Securely store the Secret ID. You enter it in Secret ID when you configure the source.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.