hashicorp / hashicorp/consul

Running Vault as Consul Connect CA with AWS IAM Auth does not respect "header_value" in Connect config.

Open
#23,297 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
30.1k
Forks
4.6k
Avg merge
1d 18h
Merged PRs (30d)
39

Description

#### Overview of the Issue

We are using Vault as the Consul Connect CA. We are running Consul and Vault on AWS, and would like to authenticate to Vault using AWS IAM Auth. We are setting the `iam_server_id_header_value`.

However, despite setting `header_value` in the Consul Connect config, we are unable to connect to Vault to use as a CA, and we get the following error despite setting "header_value" as per [the docs](https://developer.hashicorp.com/vault/docs/agent-and-proxy/autoauth/methods/aws#configuration).

```
[ERROR] connect.ca: Failed to initialize Connect CA: routine="CA initialization"
error=
| error configuring provider: Error making API request.
|
| URL: PUT https://vault.8080.co/v1/auth/aws/login
| Code: 400. Errors:
|
| * error validating X-Vault-AWS-IAM-Server-ID header: missing header "X-Vault-AWS-IAM-Server-ID"
```

---

#### Reproduction Steps

1. Stand up Vault on AWS and bootstrap it
2. Set up Vault AWS Auth. We used the following TF script:

```
resource "vault_auth_backend" "aws" {
type = "aws"
description = "AWS IAM Authentication into Vault"
}

resource "vault_aws_auth_backend_client" "aws_iam" {
backend = vault_auth_backend.aws.path
iam_server_id_header_value = "vault."
}
```
3. Create the Vault AWS auth backend roles and policy. We used the following TF script:

```
variable "aws_region" {
default = "us-east-1"
}

variable "env" {
default = "production"
}

locals {
vault_consul_service_mesh_ca_root = "service_mesh/pki_root/${var.env}"
vault_consul_service_mesh_ca_inter = "service_mesh/pki_int/${var.env}/aws/${var.aws_region}"
}

resource "vault_aws_auth_backend_role" "consul_server" {
backend = local.vault_aws_auth_path
role = aws_iam_role.consul_server.name

auth_type = "iam"

bound_iam_principal_arns = [aws_iam_role.consul_server.arn]

token_ttl = 300
token_max_ttl = 300

token_policies = [vault_policy.consul_service_mesh.name]
}


resource "vault_policy" "consul_service_mesh" {
name = "consul-service-mesh-${var.env}-${var.aws_region}"
policy = <

Contributor guide

Open the contributing guide

Research direction

Start in agent/connect/ca/provider_vault_auth_aws.go and compare how connect.ca_config.params.header_value reaches consul-awsauth's LoginInput.ServerIDHeaderName. Reproduce the AWS IAM authentication configuration from the issue, then verify the Consul Connect CA can authenticate to Vault with the X-Vault-AWS-IAM-Server-ID header. The issue is done when the documented header_value configuration works without the missing-header error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.