mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Merge branch 'heads/main' into daniel/ms-teams-integration
This commit is contained in:
Daniel Hougaard
@@ -41,3 +41,16 @@ Dynamic secrets are particularly useful in environments with stringent security
|
||||
4. [Oracle](./oracle)
|
||||
6. [Redis](./redis)
|
||||
5. [AWS IAM](./aws-iam)
|
||||
|
||||
**FAQ**
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Why is my SQL dynamic secret failing when I generate a lease?">
|
||||
This usually happens when the SQL statements defined for creating or revoking the secret are not compatible with your database provider.
|
||||
|
||||
Different SQL engines have different expectations for quoting identifiers and values. For example, some use backticks (`` `username` ``), others use single quotes (`'username'`), and some expect double quotes (`"username"`). A statement that works on one provider might fail on another.
|
||||
|
||||
**Recommendation:**
|
||||
Make sure to adjust your SQL statements to follow the syntax required by your specific database provider. Always test them directly on your target database to ensure they execute without errors.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Auth0 Client Secret"
|
||||
title: "Auth0 Client Secret Rotation"
|
||||
description: "Learn how to automatically rotate Auth0 Client Secrets."
|
||||
---
|
||||
|
||||
|
||||
@@ -0,0 +1,191 @@
|
||||
---
|
||||
title: "AWS IAM User"
|
||||
description: "Learn how to automatically rotate Access Key Id and Secret Key of AWS IAM Users."
|
||||
---
|
||||
|
||||
Infisical's AWS IAM User secret rotation capability lets you update the **Access key** and **Secret access key** credentials of a target IAM user from within Infisical
|
||||
at a specified interval or on-demand.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Create an [AWS Connection](/integrations/app-connections/aws) with the required **Secret Rotation** permissions
|
||||
- Make sure to add the following permissions to your IAM Role/IAM User Permission policy set used by your AWS Connection:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"iam:ListAccessKeys",
|
||||
"iam:CreateAccessKey",
|
||||
"iam:UpdateAccessKey",
|
||||
"iam:DeleteAccessKey",
|
||||
"iam:ListUsers"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Workflow
|
||||
|
||||
The typical workflow for using the AWS IAM User rotation strategy consists of four steps:
|
||||
|
||||
1. Creating the target IAM user whose credentials you wish to rotate.
|
||||
2. Configuring the rotation strategy in Infisical with the credentials of the managing IAM user.
|
||||
3. Pressing the **Rotate** button in the Infisical dashboard to trigger the rotation of the target IAM user's credentials. The strategy can also be configured to rotate the credentials automatically at a specified interval.
|
||||
|
||||
In the following steps, we explore the end-to-end workflow for setting up this strategy in Infisical.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create the target IAM user">
|
||||
To begin, create an IAM user whose credentials you wish to rotate. If you already have an IAM user,
|
||||
then you can skip this step.
|
||||
</Step>
|
||||
<Step title="Configure the AWS IAM User secret rotation strategy in Infisical">
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to your Secret Manager Project's Dashboard and select **Add Secret Rotation** from the actions dropdown.
|
||||
|
||||
|
||||
2. Select the **AWS IAM User Secret** option.
|
||||
|
||||
|
||||
3. Select the **AWS Connection** to use and configure the rotation behavior. Then click **Next**.
|
||||
|
||||
|
||||
- **AWS Connection** - the connection that will perform the rotation of the specified application's Client Secret.
|
||||
- **Rotation Interval** - the interval, in days, that once elapsed will trigger a rotation.
|
||||
- **Rotate At** - the local time of day when rotation should occur once the interval has elapsed.
|
||||
- **Auto-Rotation Enabled** - whether secrets should automatically be rotated once the rotation interval has elapsed. Disable this option to manually rotate secrets or pause secret rotation.
|
||||
|
||||
4. Select the AWS IAM user and the region of the user whose credentials you want to rotate. Then click **Next**.
|
||||
|
||||
|
||||
5. Specify the secret names that the AWS IAM access key credentials should be mapped to. Then click **Next**.
|
||||
|
||||
|
||||
- **Access Key ID** - the name of the secret that the AWS access key ID will be mapped to.
|
||||
- **Secret Access Key** - the name of the secret that the rotated secret access key will be mapped to.
|
||||
|
||||
6. Give your rotation a name and description (optional). Then click **Next**.
|
||||
|
||||
|
||||
- **Name** - the name of the secret rotation configuration. Must be slug-friendly.
|
||||
- **Description** (optional) - a description of this rotation configuration.
|
||||
|
||||
7. Review your configuration, then click **Create Secret Rotation**.
|
||||
|
||||
|
||||
8. Your **AWS IAM User** credentials are now available for use via the mapped secrets.
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an AWS IAM User Rotation, make an API request to the [Create AWS IAM User Rotation](/api-reference/endpoints/secret-rotations/aws-iam-user-secret/create) API endpoint.
|
||||
|
||||
You will first need the **User Name** of the AWS IAM user you want to rotate the secret for. This can be obtained from the IAM console, on Users tab.
|
||||
|
||||
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://us.infisical.com/api/v2/secret-rotations/aws-iam-user-secret \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-aws-rotation",
|
||||
"projectId": "9602cfc5-20b9-4c35-a056-dd7372db0f25",
|
||||
"description": "My rotation strategy description",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/",
|
||||
"isAutoRotationEnabled": true,
|
||||
"rotationInterval": 2,
|
||||
"rotateAtUtc": {
|
||||
"hours": 11.5,
|
||||
"minutes": 29.5
|
||||
},
|
||||
"parameters": {
|
||||
"userName": "testUser",
|
||||
"region": "us-east-1"
|
||||
},
|
||||
"secretsMapping": {
|
||||
"accessKeyId": "AWS_ACCESS_KEY_ID",
|
||||
"secretAccessKey": "AWS_SECRET_ACCESS_KEY"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretRotation": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-aws-rotation",
|
||||
"description": "My rotation strategy description",
|
||||
"secretsMapping": {
|
||||
"accessKeyId": "AWS_ACCESS_KEY_ID",
|
||||
"secretAccessKey": "AWS_SECRET_ACCESS_KEY"
|
||||
},
|
||||
"isAutoRotationEnabled": true,
|
||||
"activeIndex": 0,
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"rotationInterval": 123,
|
||||
"rotationStatus": "success",
|
||||
"lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
|
||||
"lastRotatedAt": "2023-11-07T05:31:56Z",
|
||||
"lastRotationJobId": null,
|
||||
"nextRotationAt": "2023-11-07T05:31:56Z",
|
||||
"isLastRotationManual": true,
|
||||
"connection": {
|
||||
"app": "aws",
|
||||
"name": "my-aws-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"projectId": "9602cfc5-20b9-4c35-a056-dd7372db0f25",
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/"
|
||||
},
|
||||
"rotateAtUtc": {
|
||||
"hours": 11.5,
|
||||
"minutes": 29.5
|
||||
},
|
||||
"lastRotationMessage": null,
|
||||
"type": "aws-iam-user-secret",
|
||||
"parameters": {
|
||||
"userName": "testUser",
|
||||
"region": "us-east-1"
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
**FAQ**
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Why are my AWS IAM credentials not rotating?">
|
||||
There are a few reasons for why this might happen:
|
||||
- The strategy configuration is invalid (e.g. the managing IAM user's credentials are incorrect, the target AWS region is incorrect, etc.)
|
||||
- The managing IAM user is insufficently permissioned to rotate the credentials of the target IAM user. For instance, you may have setup
|
||||
[paths](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/) for the managing IAM user and the policy does not have the necessary
|
||||
permissions to rotate the credentials.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
@@ -1,143 +0,0 @@
|
||||
---
|
||||
title: "AWS IAM User"
|
||||
description: "Learn how to automatically rotate Access Key Id and Secret Key of AWS IAM Users."
|
||||
---
|
||||
|
||||
Infisical's AWS IAM User secret rotation capability lets you update the **Access key** and **Secret access key** credentials of a target IAM user from within Infisical
|
||||
at a specified interval or on-demand.
|
||||
|
||||
## Workflow
|
||||
|
||||
The typical workflow for using the AWS IAM User rotation strategy consists of four steps:
|
||||
|
||||
1. Creating the target IAM user whose credentials you wish to rotate.
|
||||
2. Creating the managing IAM user used by Infisical to rotate the credentials of the target IAM user.
|
||||
3. Configuring the rotation strategy in Infisical with the credentials of the managing IAM user.
|
||||
4. Pressing the **Rotate** button in the Infisical dashboard to trigger the rotation of the target IAM user's credentials. The strategy can also be configured to rotate the credentials automatically at a specified interval.
|
||||
|
||||
In the following steps, we explore the end-to-end workflow for setting up this strategy in Infisical.
|
||||
|
||||
<Steps>
|
||||
<Step title="Create the target IAM user">
|
||||
To begin, create an IAM user whose credentials you wish to rotate. If you already have an IAM user,
|
||||
then you can skip this step.
|
||||
</Step>
|
||||
<Step title="Create the managing IAM user">
|
||||
Next, create another IAM user to be used by Infisical to rotate the credentials of the IAM user in the previous step.
|
||||
|
||||
2.1. In your AWS console, head to IAM > Access management > Users and press **Create user**.
|
||||
|
||||
|
||||
|
||||
2.2. Next, give the user a username like **infisical-rotation-manager** and press **Next**.
|
||||
|
||||
|
||||
|
||||
2.3. Next, in the **Set permissions** step, select **Attach policies directly** and then press **Create policy**.
|
||||
|
||||
|
||||
|
||||
2.4. Next, in the **Policy editor**, paste the following JSON and press **Next**:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Sid": "VisualEditor0",
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"iam:DeleteAccessKey",
|
||||
"iam:GetAccessKeyLastUsed",
|
||||
"iam:CreateAccessKey"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
<Note>
|
||||
The IAM policy above uses the wildcard option in Resource: "*".
|
||||
|
||||
You may want to restrict the policy to a specific path, and make any adjustments as necessary, to control access for the managing user in production.
|
||||
|
||||
Read more about this [here](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/).
|
||||
</Note>
|
||||
|
||||
In the **Review and create** step, give the policy a name like **infisical-rotation-manager**, press **Create policy** to finish creating the policy.
|
||||
|
||||
|
||||
|
||||
2.5. Back in the **Set permissions** step from step 2.3, refresh the policy list and search for the policy you just created from step 2.4.
|
||||
|
||||
Select the policy and press **Next**.
|
||||
|
||||
|
||||
|
||||
In the **Review and create** step, press **Create user** to finish creating the IAM user.
|
||||
|
||||
|
||||
|
||||
2.5. Having created the user, head to its Security credentials > Access keys and press **Create access key**.
|
||||
|
||||
Follow the subsequent steps to create the **access key** and **secret access key** credential pair for the user.
|
||||
|
||||
|
||||
|
||||
At the end of the flow, copy the **Access key** and **Secret access key** to use when configuring the AWS IAM User rotation strategy back in Infisical next.
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Configure the AWS IAM User secret rotation strategy in Infisical">
|
||||
3.1. Back in Infisical, head to the Project > Secrets > Environment and path where you want the rotated AWS IAM credentials to appear and create two placeholder secrets.
|
||||
|
||||
In this example, we'll create two secrets called `AWS_ACCESS_KEY` and `AWS_SECRET_ACCESS_KEY`.
|
||||
|
||||
|
||||
|
||||
3.2. Next, in the **Secret Rotation** tab, press on the **AWS IAM** tile to configure the AWS IAM User rotation strategy.
|
||||
|
||||
|
||||
|
||||
3.3. Input the configuration details for the AWS IAM User rotation strategy obtained from steps 1 and 2:
|
||||
|
||||
|
||||
|
||||
Here's some guidance on each field:
|
||||
|
||||
- Manager User Access Key: The managing IAM user's access key from step 2.5.
|
||||
- Manager User Secret Key: The managing IAM user's secret access key from step 2.5.
|
||||
- Manager User AWS Region: The [AWS region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html) for Infisical to make requests to such as `us-east-1`.
|
||||
- IAM Username: The IAM username of the user from step 1.
|
||||
|
||||
Next, specify the output secret mappings configuration for the rotated AWS IAM credentials; this is the secrets whose values will be replaced with new credentials after each rotation.
|
||||
Here, you can also specify a rotation interval for the credentials to be automatically rotated periodically.
|
||||
|
||||
In this example, we want to map the output of the rotated AWS IAM credentials to the secrets that we created in step 3.1 (i.e. `AWS_ACCESS_KEY` and `AWS_SECRET_ACCESS_KEY`).
|
||||
|
||||
|
||||
|
||||
Finally, press **Submit** to create the secret rotation strategy.
|
||||
</Step>
|
||||
<Step title="Rotate secrets in Infisical">
|
||||
You should now see the AWS IAM User rotation strategy listed in the **Secret Rotation** tab.
|
||||
|
||||
To manually trigger a rotation, you can press the **Rotate** button on the strategy.
|
||||
Once triggered, the secrets in step 3.1 should be updated with new rotated credential values.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
**FAQ**
|
||||
|
||||
<AccordionGroup>
|
||||
<Accordion title="Why are my AWS IAM credentials not rotating?">
|
||||
There are a few reasons for why this might happen:
|
||||
|
||||
- The strategy configuration is invalid (e.g. the managing IAM user's credentials are incorrect, the target IAM username is incorrect, etc.).
|
||||
- The managing IAM user is insufficently permissioned to rotate the credentials of the target IAM user. For instance, you may have setup [paths](https://aws.amazon.com/blogs/security/optimize-aws-administration-with-iam-paths/) for the managing IAM user and the policy does not have the necessary permissions to rotate the credentials.
|
||||
- The target IAM user already has 2 access keys configured in AWS; you should delete one of the access keys to allow for rotation.
|
||||
</Accordion>
|
||||
</AccordionGroup>
|
||||
173
docs/documentation/platform/secret-rotation/ldap-password.mdx
Normal file
173
docs/documentation/platform/secret-rotation/ldap-password.mdx
Normal file
@@ -0,0 +1,173 @@
|
||||
---
|
||||
title: "LDAP Password Rotation"
|
||||
description: "Learn how to automatically rotate LDAP passwords."
|
||||
---
|
||||
|
||||
<Note>
|
||||
Due to how LDAP passwords are rotated, retired credentials will not be able to
|
||||
authenticate with the LDAP provider during their [inactive period](./overview#how-rotation-works).
|
||||
|
||||
This is a limitation of the LDAP provider and cannot be
|
||||
rectified by Infisical.
|
||||
</Note>
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Create an [LDAP Connection](/integrations/app-connections/ldap) with the **Secret Rotation** requirements
|
||||
|
||||
## Create an LDAP Password Rotation in Infisical
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
1. Navigate to your Secret Manager Project's Dashboard and select **Add Secret Rotation** from the actions dropdown.
|
||||
|
||||
|
||||
2. Select the **LDAP Password** option.
|
||||
|
||||
|
||||
3. Select the **LDAP Connection** to use and configure the rotation behavior. Then click **Next**.
|
||||
|
||||
|
||||
- **LDAP Connection** - the connection that will perform the rotation of the configured DN's password.
|
||||
<Note>
|
||||
LDAP Password Rotations require an LDAP Connection that uses ldaps:// protocol.
|
||||
</Note>
|
||||
- **Rotation Interval** - the interval, in days, that once elapsed will trigger a rotation.
|
||||
- **Rotate At** - the local time of day when rotation should occur once the interval has elapsed.
|
||||
- **Auto-Rotation Enabled** - whether secrets should automatically be rotated once the rotation interval has elapsed. Disable this option to manually rotate secrets or pause secret rotation.
|
||||
<Note>
|
||||
Due to LDAP Password Rotations rotating a single credential set, auto-rotation may result in service interruptions. If you need to ensure service continuity, we recommend disabling this option.
|
||||
</Note>
|
||||
|
||||
|
||||
4. Specify the Distinguished Name (DN) of the principal whose password you want to rotate and configure the password requirements. Then click **Next**.
|
||||
|
||||
|
||||
5. Specify the secret names that the client credentials should be mapped to. Then click **Next**.
|
||||
|
||||
|
||||
- **DN** - the name of the secret that the principal's Distinguished Name (DN) will be mapped to.
|
||||
- **Password** - the name of the secret that the rotated password will be mapped to.
|
||||
|
||||
6. Give your rotation a name and description (optional). Then click **Next**.
|
||||
|
||||
|
||||
- **Name** - the name of the secret rotation configuration. Must be slug-friendly.
|
||||
- **Description** (optional) - a description of this rotation configuration.
|
||||
|
||||
7. Review your configuration, then click **Create Secret Rotation**.
|
||||
|
||||
|
||||
8. Your **LDAP Password** credentials are now available for use via the mapped secrets.
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an LDAP Password Rotation, make an API request to the [Create LDAP
|
||||
Password Rotation](/api-reference/endpoints/secret-rotations/ldap-password/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://us.infisical.com/api/v2/secret-rotations/ldap-password \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-ldap-rotation",
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"description": "my ldap password rotation",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"environment": "dev",
|
||||
"secretPath": "/",
|
||||
"isAutoRotationEnabled": false,
|
||||
"rotationInterval": 30,
|
||||
"rotateAtUtc": {
|
||||
"hours": 0,
|
||||
"minutes": 0
|
||||
},
|
||||
"parameters": {
|
||||
"dn": "CN=John,CN=Users,DC=example,DC=com",
|
||||
"passwordRequirements": {
|
||||
"length": 48,
|
||||
"required": {
|
||||
"digits": 2,
|
||||
"lowercase": 2,
|
||||
"uppercase": 2,
|
||||
"symbols": 2
|
||||
},
|
||||
"allowedSymbols": "-_.~!*"
|
||||
}
|
||||
},
|
||||
"secretsMapping": {
|
||||
"dn": "LDAP_DN",
|
||||
"password": "LDAP_PASSWORD"
|
||||
}
|
||||
}'
|
||||
```
|
||||
|
||||
<Note>
|
||||
Due to LDAP Password Rotations rotating a single credential set, auto-rotation may result in service interruptions. If you need to ensure service continuity, we recommend disabling this option.
|
||||
</Note>
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
"secretRotation": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"name": "my-ldap-rotation",
|
||||
"description": "my ldap password rotation",
|
||||
"secretsMapping": {
|
||||
"dn": "LDAP_DN",
|
||||
"password": "LDAP_PASSWORD"
|
||||
},
|
||||
"isAutoRotationEnabled": false,
|
||||
"activeIndex": 0,
|
||||
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"createdAt": "2023-11-07T05:31:56Z",
|
||||
"updatedAt": "2023-11-07T05:31:56Z",
|
||||
"rotationInterval": 30,
|
||||
"rotationStatus": "success",
|
||||
"lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
|
||||
"lastRotatedAt": "2023-11-07T05:31:56Z",
|
||||
"lastRotationJobId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"nextRotationAt": "2023-11-07T05:31:56Z",
|
||||
"connection": {
|
||||
"app": "ldap",
|
||||
"name": "my-ldap-connection",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"environment": {
|
||||
"slug": "dev",
|
||||
"name": "Development",
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"folder": {
|
||||
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"path": "/"
|
||||
},
|
||||
"rotateAtUtc": {
|
||||
"hours": 0,
|
||||
"minutes": 0
|
||||
},
|
||||
"lastRotationMessage": null,
|
||||
"type": "ldap-password",
|
||||
"parameters": {
|
||||
"dn": "CN=John,CN=Users,DC=example,DC=com",
|
||||
"passwordRequirements": {
|
||||
"length": 48,
|
||||
"required": {
|
||||
"digits": 2,
|
||||
"lowercase": 2,
|
||||
"uppercase": 2,
|
||||
"symbols": 2
|
||||
},
|
||||
"allowedSymbols": "-_.~!*"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
</Tab>
|
||||
</Tabs>
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "Microsoft SQL Server Credentials"
|
||||
title: "Microsoft SQL Server Credentials Rotation"
|
||||
description: "Learn how to automatically rotate Microsoft SQL Server credentials."
|
||||
---
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
---
|
||||
title: "PostgreSQL Credentials"
|
||||
title: "PostgreSQL Credentials Rotation"
|
||||
description: "Learn how to automatically rotate PostgreSQL credentials."
|
||||
---
|
||||
|
||||
|
||||
@@ -10,10 +10,10 @@ Infisical SSH can be configured to provide users on your team short-lived, secur
|
||||
and improves upon traditional SSH key-based authentication by mitigating private key compromise, static key management,
|
||||
unauthorized access, and SSH key sprawl.
|
||||
|
||||
The following entities and concepts are important to understand when using Infisical SSH:
|
||||
The following entities are important to understand when configuring and using Infisical SSH:
|
||||
|
||||
- Administrator: An individual on your team who is responsible for configuring Infisical SSH.
|
||||
- Users: Other individuals on your team that need access to the remote host.
|
||||
- Users: Other individuals that gain access to remote hosts through Infisical SSH.
|
||||
- Host: A remote machine (e.g. EC2 instance, GCP VM, Azure VM, on-prem Linux server, Raspberry Pi, VMware VM, etc.) that users need SSH access to that is registered with Infisical SSH.
|
||||
|
||||
## Workflow
|
||||
@@ -72,7 +72,7 @@ we will register a remote host with Infisical through a [machine identity](/docu
|
||||
Next, use the `infisical ssh add-host` command to register the remote host with Infisical. As part of this command, input the ID of the Infisical SSH project you created in step 1 for the `--projectId` flag and the hostname of the remote host for the `--hostname` flag.
|
||||
|
||||
```bash
|
||||
sudo infisical ssh add-host --projectId=<project-id> --hostname=<hostname> --token="$INFISICAL_TOKEN" --writeUserCaToFile --writeHostCertToFile --configureSshd
|
||||
sudo infisical ssh add-host --projectId=<project-id> --hostname=<hostname> --token="$INFISICAL_TOKEN" --write-user-ca-to-file --write-host-cert-to-file --configure-sshd
|
||||
```
|
||||
|
||||
<Tip>
|
||||
@@ -136,44 +136,66 @@ Once Infisical SSH is configured by an administrator, users can SSH to the remot
|
||||
<Step title="Install the Infisical CLI">
|
||||
Follow the instructions [here](/cli/overview) to install the Infisical CLI onto your local machine.
|
||||
</Step>
|
||||
<Step title="Log in with the CLI">
|
||||
Run the `infisical login` command to authenticate with Infisical.
|
||||
|
||||
```bash
|
||||
infisical login
|
||||
```
|
||||
</Step>
|
||||
<Step title="Connect to the remote host">
|
||||
Run the `infisical ssh connect` command to connect to a remote host.
|
||||
The `infisical ssh connect` command can be used in either interactive or non-interactive mode to connect to a remote host.
|
||||
|
||||
```bash
|
||||
infisical ssh connect
|
||||
```
|
||||
<Tabs>
|
||||
<Tab title="Interactive Mode">
|
||||
In interactive mode, you'll first need to authenticate with Infisical by running:
|
||||
|
||||
You'll be prompted to select an SSH Host from a list of accessible hosts; this is based on project membership and login mappings configured on hosts by
|
||||
the administrator.
|
||||
```bash
|
||||
infisical login
|
||||
```
|
||||
|
||||
```bash
|
||||
Use the arrow keys to navigate: ↓ ↑ → ←
|
||||
? Select an SSH Host:
|
||||
▸ ec2-12-345-678-910.ap-northeast-1.compute.amazonaws.com
|
||||
```
|
||||
Then simply run:
|
||||
|
||||
After selecting a host, you'll be prompted to select a login user from a list of allowed login users:
|
||||
```bash
|
||||
infisical ssh connect
|
||||
```
|
||||
|
||||
```bash
|
||||
? Select Login User:
|
||||
▸ ec2-user
|
||||
```
|
||||
You'll be prompted to select an SSH Host from a list of accessible hosts; this is based on project membership and login mappings configured on hosts by
|
||||
the administrator.
|
||||
|
||||
If successful, you should be able to SSH to the remote host.
|
||||
```bash
|
||||
Use the arrow keys to navigate: ↓ ↑ → ←
|
||||
? Select an SSH Host:
|
||||
▸ ec2-12-345-678-910.ap-northeast-1.compute.amazonaws.com
|
||||
```
|
||||
|
||||
```bash
|
||||
✔ ec2-54-199-104-116.ap-northeast-1.compute.amazonaws.com
|
||||
✔ ec2-user
|
||||
✔ SSH credentials successfully added to agent
|
||||
Connecting to ec2-user@ec2-12-345-678-910.ap-northeast-1.compute.amazonaws.com...
|
||||
```
|
||||
After selecting a host, you'll be prompted to select a login user from a list of allowed login users:
|
||||
|
||||
```bash
|
||||
? Select Login User:
|
||||
▸ ec2-user
|
||||
```
|
||||
|
||||
If successful, you should be able to SSH to the remote host.
|
||||
|
||||
```bash
|
||||
✔ ec2-54-199-104-116.ap-northeast-1.compute.amazonaws.com
|
||||
✔ ec2-user
|
||||
✔ SSH credentials successfully added to agent
|
||||
Connecting to ec2-user@ec2-12-345-678-910.ap-northeast-1.compute.amazonaws.com...
|
||||
```
|
||||
</Tab>
|
||||
<Tab title="Non-Interactive Mode">
|
||||
For CI/CD pipelines or automation scenarios, you can use the non-interactive mode with an Infisical token:
|
||||
|
||||
```bash
|
||||
infisical ssh connect \
|
||||
--hostname ec2-12-345-678-910.ap-northeast-1.compute.amazonaws.com \
|
||||
--login-user ec2-user \
|
||||
--out-file-path ~/.ssh/id_rsa-cert.pub \
|
||||
--token <your-infisical-token>
|
||||
```
|
||||
|
||||
This will:
|
||||
- Connect to the specified hostname
|
||||
- Use the specified login user
|
||||
- Write the SSH credentials to the specified path instead of adding them to the SSH agent
|
||||
- Authenticate using the provided Infisical token
|
||||
</Tab>
|
||||
</Tabs>
|
||||
</Step>
|
||||
|
||||
</Steps>
|
||||
|
||||
Reference in New Issue
Block a user