Security mandates for Storage Fusion credentials and MCG integration to S3

ITAU Bank is one of the largest private banks in Brazil. Customer is very advanced in Cloud Adoption, having AWS as their main partner and managing over 9K AWS accounts.

While providing agility and independence, their methodology also increases in complexity and potential security risks. Customer employs strict security practices (mandates and guardrails) for managing and delivering credentials, utilizing Hashicorp Vault as a external vault, to minimize exposure and ensuring the credentials rotation.

So in this sense, customer need the Storage Fusion being able to integrate with external vaults to manage its credentials. Also, for the MultiCloud Gateway S3 integration, customer does not want to use the HMAC Access Key and Secret Keys or manage it. An alternative to vault integration is the use of IAM roles, which is more restrictive and least privilege possible for accessing those S3 Buckets.

Following the task flow customer expect as the integration between Fusion and the external vault (Hashicorp)

Authentication

curl \
--cacert CA-cert.pem \
--cert arquivoDeCertificado.crt \
--key arquivoDeChavePrivada.key \
--request POST \
https://vault.itau:8200/v1/auth/cert/login

The most important parms from the command above are: client_token and lease_duration:

{
...
"auth": {
"client_token": "cf95f87d-f95b-47ff-b1f5-ba7bff850425",
...
"lease_duration": 3600,
...
}
...
}

Recover the credentails from vault

Using the client_token, you can recover the secret, which will generate the AWS credentials:

curl \
--cacert CA-cert.pem \
--header "X-Vault-Token: cf95f87d-f95b...." \
--request GET \
https://vault.itau:8200/v1/aws/creds/role-fornecida-pela-squadGSCE

Results

{
"data": {
"access_key": "AKIA...",
"secret_key": "xlCs...",
"security_token": "243Hdbs...",
"arn": "arn:aws:sts::123456789012:assumed-role/DeveloperRole/some-user-supplied-role-session-name",
"ttl": 3600
}
}

Export the environment variables

export AWS_ACCESS_KEY_ID= AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
export AWS_DEFAULT_REGION=região
export AWS_SESSION_TOKEN=IQoJb3JpZ2luX2VjEMP//////////wEaCXNhLWVhc3QtMSJIMEYCIQDM

Customer will not go into production without this feature implemented or in a clear roadmap.