Dynamic AWS IAM Credentials with HashiCorp Vault

Long-lived AWS access keys pose a significant security risk; if leaked, they remain valid until manually revoked. HashiCorp Vault solves this by generating short-lived, dynamic IAM credentials that are automatically revoked after a set duration, minimizing the impact of potential leaks.

How Vault Generates Dynamic Credentials

Vault acts as a credential manager for AWS by dynamically creating IAM users with temporary access keys. It uses the AWS API to create a temporary IAM user, attaches a specified IAM policy, and returns the access keys. Vault tracks these credentials with a lease ID and revokes them when the lease expires.

Configuring the AWS Secrets Engine

To use this feature, you must enable the AWS secrets engine in Vault and provide it with administrative credentials that have permission to manage IAM users and policies. Run these commands with Vault administrative privileges:

# Enable the AWS secrets engine
vault secrets enable aws

# Configure the engine with admin credentials
# Replace placeholders with actual admin keys
vault write aws/config/ \
    access_key=AKIA_EXAMPLE \
    secret_key=EXAMPLE_SECRET \
    region=us-east-1

Once configured, define a role that maps to an AWS IAM policy and specifies the Time-to-Live (TTL) for generated keys:

# Create a role for a read-only S3 application
vault write aws/roles/s3-reader \
    iam_policy_arn="arn:aws:iam::123456789012:policy/AmazonS3ReadOnlyAccess" \
    default_ttl=1h \
    max_ttl=4h

Requesting and Verifying Credentials

Applications or developers request credentials by reading the role path. Vault generates a unique set of keys on-the-fly:

# Request dynamic credentials
vault read aws/creds/s3-reader

Expected output:

{
  "access_key_id" : "AKIA...",
  "secret_access_key" : "...",
  "security_token" : "...",
  "lease_id" : "aws/creds/s3-reader/...",
  "lease_duration" : "3600"
}

To verify the credentials work, use the AWS CLI with the returned environment variables:

# Export the returned keys and test access
export AWS_ACCESS_KEY_ID="AKIA..."
export AWS_SECRET_ACCESS_KEY="..."
aws s3 ls-buckets

Common Pitfalls and Limits

• TTL Mismatches: AWS imposes a maximum duration for temporary credentials (often 12 hours for IAM sessions). If your Vault max_ttl exceeds the AWS limit, Vault will return an error during role creation.
• Policy Validation: Vault does not validate the logic of your IAM policy JSON. If the ARN is incorrect or the policy is malformed, the credentials will be generated but will result in 403 Forbidden errors from AWS.
• Credential Scoping: The master credentials provided to Vault must have iam:CreateUser, iam:DeleteUser, and iam:AttachUserPolicy permissions.
• Abandoned Credentials: If the Vault cluster goes down without revoking the lease, the credentials may remain active in AWS. Ensure Vault is deployed with high availability to manage the lease lifecycle reliably.

Verification of Lifecycle

To ensure the system is working correctly, manually revoke a lease and check the AWS environment:

# List active leases for AWS
vault lease list

# Manually revoke a lease
vault lease revoke aws/creds/s3-reader/...