Vault PostgreSQL Custom Plugin

This is a custom HashiCorp Vault plugin created for learning and experimentation purposes.

Overview

This plugin demonstrates how to build a custom secrets engine for HashiCorp Vault that integrates with PostgreSQL databases. It provides dynamic credential generation and management for PostgreSQL databases.

Features

• Dynamic Database Credentials: Generate temporary PostgreSQL users with configurable permissions
• Role-based Access: Define roles with specific SQL creation statements and TTL policies
• Credential Management: Automatic credential lifecycle management with configurable TTLs
• RESTful API: Standard Vault API endpoints for configuration and credential operations

Project Structure

vault-custom-plugin/
├── main.go              # Plugin entry point and Vault integration
├── backend.go           # Backend implementation with embedded framework
├── client.go            # PostgreSQL client implementation
├── path_config.go       # Configuration endpoint handlers (/config)
├── path_roles.go        # Role management endpoints (/roles/*)
├── path_creds.go        # Credential generation endpoints (/creds/*)
├── go.mod               # Go module dependencies
├── go.sum               # Dependency checksums
└── README.md           # This file

API Endpoints

Configuration

• PUT /config - Configure database connection
• GET /config - Retrieve current configuration
• DELETE /config - Remove configuration

Role Management

• PUT /roles/{name} - Create or update a role
• GET /roles/{name} - Read role configuration
• DELETE /roles/{name} - Delete a role
• LIST /roles/ - List all roles

Credential Generation

• GET /creds/{role} - Generate credentials for a role

Example Usage

1. Configure Database Connection

vault write database/config/postgresql \
    connection_url="postgresql://username:password@localhost:5432/mydb?sslmode=disable"

2. Create a Role

vault write database/roles/readonly \
    creation_statements="CREATE USER '{{name}}' WITH PASSWORD '{{password}}'; GRANT SELECT ON ALL TABLES IN SCHEMA public TO '{{name}}';" \
    default_ttl=3600 \
    max_ttl=7200

3. Generate Credentials

vault read database/creds/readonly

Building and Development

Prerequisites

• Go 1.19+
• PostgreSQL database for testing
• HashiCorp Vault (for testing)

Build

go build -o vault-postgres-plugin

Testing

go test ./...
TODO: Add tests