Running Vault as Consul Connect CA with AWS IAM Auth does not respect "header_value" in Connect config.
- Dominant language
- Go
- Stars
- 30.1k
- Forks
- 4.6k
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 39
Description
#### Overview of the Issue
We are using Vault as the Consul Connect CA. We are running Consul and Vault on AWS, and would like to authenticate to Vault using AWS IAM Auth. We are setting the `iam_server_id_header_value`.
However, despite setting `header_value` in the Consul Connect config, we are unable to connect to Vault to use as a CA, and we get the following error despite setting "header_value" as per [the docs](https://developer.hashicorp.com/vault/docs/agent-and-proxy/autoauth/methods/aws#configuration).
```
[ERROR] connect.ca: Failed to initialize Connect CA: routine="CA initialization"
error=
| error configuring provider: Error making API request.
|
| URL: PUT https://vault.8080.co/v1/auth/aws/login
| Code: 400. Errors:
|
| * error validating X-Vault-AWS-IAM-Server-ID header: missing header "X-Vault-AWS-IAM-Server-ID"
```
---
#### Reproduction Steps
1. Stand up Vault on AWS and bootstrap it
2. Set up Vault AWS Auth. We used the following TF script:
```
resource "vault_auth_backend" "aws" {
type = "aws"
description = "AWS IAM Authentication into Vault"
}
resource "vault_aws_auth_backend_client" "aws_iam" {
backend = vault_auth_backend.aws.path
iam_server_id_header_value = "vault."
}
```
3. Create the Vault AWS auth backend roles and policy. We used the following TF script:
```
variable "aws_region" {
default = "us-east-1"
}
variable "env" {
default = "production"
}
locals {
vault_consul_service_mesh_ca_root = "service_mesh/pki_root/${var.env}"
vault_consul_service_mesh_ca_inter = "service_mesh/pki_int/${var.env}/aws/${var.aws_region}"
}
resource "vault_aws_auth_backend_role" "consul_server" {
backend = local.vault_aws_auth_path
role = aws_iam_role.consul_server.name
auth_type = "iam"
bound_iam_principal_arns = [aws_iam_role.consul_server.arn]
token_ttl = 300
token_max_ttl = 300
token_policies = [vault_policy.consul_service_mesh.name]
}
resource "vault_policy" "consul_service_mesh" {
name = "consul-service-mesh-${var.env}-${var.aws_region}"
policy = <
Contributor guide
Research direction
Start in agent/connect/ca/provider_vault_auth_aws.go and compare how connect.ca_config.params.header_value reaches consul-awsauth's LoginInput.ServerIDHeaderName. Reproduce the AWS IAM authentication configuration from the issue, then verify the Consul Connect CA can authenticate to Vault with the X-Vault-AWS-IAM-Server-ID header. The issue is done when the documented header_value configuration works without the missing-header error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100