hashicorp / hashicorp/packer-plugin-amazon

Unable to leverage `vault_aws_engine` with HashiCorp Vault Enterprise - No authentication

Open
#402 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
91
Forks
141
Avg merge
2d 18h
Merged PRs (30d)
3

Description

#### Overview of the Issue

When attempting to use the `vault_aws_engine` functionality, I continuously receive a 403 response from HashiCorp Vault. We are attempting to reduce secrets sprawl in our build environment while trying to deploy a different HashiCorp product on AWS. However, when we attempt to use the EC2 builder with EBS we are unable to get past the pre-flight validation check with credentials. It's important to note that we are using HashiCorp Vault Enterprise, and the secret we are attempting to receive resides in a namespace that is a multi-level child of the root namespace.

#### Reproduction Steps

Steps to reproduce this issue

1. Create the following Packer HCL configuration and export the following environment variables:
Environment Variables

```bash
export VAULT_ADDR="https://my.vault.cluster:8200"
export VAULT_NAMESPACE="my/namespace"
export VAULT_TOKEN="validToken"
```


Packer Config

```hcl
source "amazon-ebs" "basic-example" {
region = "us-gov-east-1"
instance_type = "t2.micro"
ssh_username = "rhel"
ami_name = "packer_AWS {{timestamp}}"

vault_aws_engine {
name = “myrole"
engine_name = “my/namespace/my/engine”
ttl = "3600s"
}

source_ami_filter {
filters = {
virtualization-type = "hvm"
name = "RHEL-8*-x86_64-*"
root-device-type = "ebs"
}
owners = ["309956199498"]
most_recent = true
}

vpc_id =
subnet_id =
}

build {
sources = [
"source.amazon-ebs.basic-example"
]
}
```


2. Execute a `packer build` with the configuration file:

Output

```bash
packer build mybuild.pkr.hcl

Error: 1 error(s) occurred:

* Error reading vault secret: Error making API request.

URL: GET https://my.vault.cluster:8200/v1/my/namespace/my/engine/creds/myrole
Code: 403. Errors:

* 1 error occurred:
* permission denied

on mybuild.pkr.hcl line 8:
(source code not available)
```


### Plugin and Packer version

From `packer version`

Packer v1.8.6

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.