transit Seal

The Transit configures Boundary to use Vault’s Transit Secret Engine for key management.

The Transit KMS is activated by the presence of a kms "transit" block in Boundary’s configuration file

transit Example

This example shows configuring Transit KMS through the Boundary configuration file by providing all the required values:

kms "transit" {
  purpose            = "root"
  address            = "https://vault:8200"
  token              = "s.Qf1s5zigZ4OX6akYjQXJC1jY"
  disable_renewal    = "false"
  // Key configuration
  key_name           = "transit_key_name"
  mount_path         = "transit/"
  namespace          = "ns1/"
  // TLS Configuration
  tls_ca_cert        = "/etc/vault/ca_cert.pem"
  tls_client_cert    = "/etc/vault/client_cert.pem"
  tls_client_key     = "/etc/vault/ca_cert.pem"
  tls_server_name    = "vault"
  tls_skip_verify    = "false"
}

kms "transit" {  purpose            = "root"  address            = "https://vault:8200"  token              = "s.Qf1s5zigZ4OX6akYjQXJC1jY"  disable_renewal    = "false"
  // Key configuration  key_name           = "transit_key_name"  mount_path         = "transit/"  namespace          = "ns1/"
  // TLS Configuration  tls_ca_cert        = "/etc/vault/ca_cert.pem"  tls_client_cert    = "/etc/vault/client_cert.pem"  tls_client_key     = "/etc/vault/ca_cert.pem"  tls_server_name    = "vault"  tls_skip_verify    = "false"}

transit Parameters

These parameters apply to the kms stanza in the Vault configuration file:

• purpose - Purpose of this KMS, acceptable values are: worker-auth, root, recovery, or config.

• address (string: <required>): The full address to the Vault cluster. This may also be specified by the VAULT_ADDR environment variable.

• token (string: <required>): The Vault token to use. This may also be specified by the VAULT_TOKEN environment variable.

• key_name (string: <required>): The transit key to use for encryption and decryption. This may also be supplied using the TRANSIT_WRAPPER_KEY_NAME environment variable.

• mount_path (string: <required>): The mount path to the transit secret engine.
  This may also be supplied using the TRANSIT_WRAPPER_MOUNT_PATH environment variable.

• namespace (string: ""): The namespace path to the transit secret engine.
  This may also be supplied using the VAULT_NAMESPACE environment variable.

• disable_renewal (string: "false"): Disables the automatic renewal of the token in case the lifecycle of the token is managed with some other mechanism outside of Vault, such as Vault Agent. This may also be specified using the TRANSIT_WRAPPER_DISABLE_RENEWAL environment variable.

• tls_ca_cert (string: ""): Specifies the path to the CA certificate file used for communication with the Vault server. This may also be specified using the VAULT_CA_CERT environment variable.

• tls_client_cert (string: ""): Specifies the path to the client certificate for communication with the Vault server. This may also be specified using the VAULT_CLIENT_CERT environment variable.

• tls_client_key (string: ""): Specifies the path to the private key for communication with the Vault server. This may also be specified using the VAULT_CLIENT_KEY environment variable.

• tls_server_name (string: ""): Name to use as the SNI host when connecting to the Vault server via TLS. This may also be specified via the VAULT_TLS_SERVER_NAME environment variable.

• tls_skip_verify (bool: "false"): Disable verification of TLS certificates. Using this option is highly discouraged and decreases the security of data transmissions to and from the Vault server. This may also be specified using the VAULT_SKIP_VERIFY environment variable.

Authentication

Authentication-related values must be provided, either as environment variables or as configuration parameters.

Note: Although the configuration file allows you to pass in token as part of the KMS stanza’s parameters, it is strongly recommended to omit the token parameter from the configuration file and set the token used to authenticate to Vault via the VAULT_TOKEN environment variable.

The Vault token used to authenticate needs the following permissions on the transit key:

path "<mount path>/encrypt/<key name>" {
  capabilities = ["update"]
}
path "<mount path>/decrypt/<key name>" {
  capabilities = ["update"]
}

path "<mount path>/encrypt/<key name>" {  capabilities = ["update"]}
path "<mount path>/decrypt/<key name>" {  capabilities = ["update"]}