layout | page_title | description |
---|---|---|
docs |
Redis ElastiCache - Database - Secrets Engines |
Redis ElastiCache is one of the supported plugins for the database secrets engine.
This plugin generates static credentials for existing managed roles. |
Redis ElastiCache is one of the supported plugins for the database secrets engine. This plugin generates static credentials for existing managed roles.
See the database secrets engine docs for more information about setting up the database secrets engine.
Plugin Name | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
---|---|---|---|---|
redis-elasticache-database-plugin |
No | No | Yes | No |
- Enable the database secrets engine if it is not already enabled:
$ vault secrets enable database
Success! Enabled the database secrets engine at: database/
By default, the secrets engine will enable at the name of the engine. To
enable the secrets engine at a different path, use the -path
argument.
- Configure Vault with the proper plugin and connection configuration:
$ vault write database/config/my-redis-elasticache-cluster \
plugin_name="redis-elasticache-database-plugin" \
url="primary-endpoint.my-cluster.xxx.yyy.cache.amazonaws.com:6379" \
access_key_id="AKI***" \
secret_access_key="ktriNYvULAWLzUmTGb***" \
region=us-east-1 \
allowed_roles="*"
~> Note: The access_key_id
, secret_access_key
and region
parameters are optional. If omitted, authentication falls back
on the AWS credentials provider chain.
~> Deprecated: The username
& password
parameters are deprecated but supported for backward compatibility. They are replaced
by the equivalent access_key_id
and secret_access_key
parameters respectively.
The Redis ElastiCache secrets engine must use AWS credentials that have sufficient permissions to manage ElastiCache users. This IAM policy sample can be used as an example. Note that <region> and <account-id> must correspond to your own environment.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Action": [
"elasticache:ModifyUser",
"elasticache:DescribeUsers"
],
"Resource": "arn:aws:elasticache:<region>:<account-id>:user:*"
}
]
}
After the secrets engine is configured, write static roles to enable generating credentials.
- Configure a static role that maps a name in Vault to an existing Redis ElastiCache user.
$ vault write database/static-roles/my-static-role \
db_name="my-redis-elasticache-cluster" \
username="my-existing-redis-user" \
rotation_period=5m
Success! Data written to: database/static-roles/my-static-role
- Retrieve the credentials from the
/static-creds
endpoint:
$ vault read database/static-creds/my-static-role
Key Value
--- -----
last_vault_rotation 2022-09-14T11:45:57.24715105-04:00
password GKdS6qY-UtVAMpcD9iuu
rotation_period 5m
ttl 4m48s
username my-existing-redis-user
~> Note: New passwords may take up-to a couple of minutes before ElastiCache has the chance to complete their configuration. It is recommended to use a retry strategy when establishing new Redis ElastiCache connections. This may prevent errors when trying to use a password that isn't yet live on the targeted ElastiCache cluster.
The full list of configurable options can be seen in the Redis ElastiCache Database Plugin API page.
For more information on the database secrets engine's HTTP API please see the Database Secrets Engine API page.