Securing RabbitMQ passwords with Vault's encryption-as-a-service

Question

Pulumi · Accepted Answer

To secure RabbitMQ passwords using Vault's encryption-as-a-service, we will perform the following steps in our Pulumi program:

1. Set up Vault's secret backend for RabbitMQ, which allows us to manage RabbitMQ credentials securely.
2. Create a Vault encryption key, which we'll use for encrypting the RabbitMQ credentials.

Let's start with the Vault secret backend for RabbitMQ. The `vault.rabbitMq.SecretBackend` resource from the [`vault`](https://www.pulumi.com/registry/packages/vault/api-docs/rabbitmq/secretbackend/) package allows us to set up a secret backend in Vault dedicated to RabbitMQ. Through this backend, we can dynamically generate credentials based on configured roles, which improves the security of our RabbitMQ instance.

After setting up the secret backend, we will use the `vault.managed.Keys` resource from the [`vault`](https://www.pulumi.com/registry/packages/vault/api-docs/managed/keys/) package to create cryptographic keys managed by Vault. These keys can be used to encrypt and decrypt data, such as RabbitMQ passwords, using Vault's encryption-as-a-service. This way, even if someone gained access to these encrypted credentials, they would not be able to use them without also gaining access to the encryption keys stored in Vault.

Now, let's translate this process into a TypeScript Pulumi program:

```typescript
import * as pulumi from '@pulumi/pulumi';
import * as vault from '@pulumi/vault';

// Create a new Vault secret backend for RabbitMQ. Replace with actual username, password, and connection URI.
const rabbitMqBackend = new vault.rabbitMq.SecretBackend("rabbitmq", {
    connectionUri: "RABBITMQ_CONNECTION_URI", // The connection URI for your RabbitMQ instance.
    username: "RABBITMQ_USERNAME",           // Your RabbitMQ management username.
    password: "RABBITMQ_PASSWORD",           // Your RabbitMQ management password.
    // Securely set these in a real scenario, such as using Pulumi configuration or ENV variables.
});

// Create a Vault key to use for encrypting RabbitMQ passwords.
const encryptionKey = new vault.managed.Keys("encryptionKey", {
    aws: [{
        name: "rabbitmq-encryption-key",
        kmsKey: "KMS_KEY_ID_HERE",             // The KMS Key ID to be used for key management.
        keyType: "aes256-gcm96",               // Type of key to use.
        keyBits: "256",                        // Number of bits to use for the key.
        region: "us-west-2",                   // The AWS region where the KMS key resides.
        accessKey: "AWS_ACCESS_KEY_ID",        // Your AWS access key ID.
        secretKey: "AWS_SECRET_ACCESS_KEY",    // Your AWS secret access key. Securely set these in a real scenario.
    }],
    // Be sure to replace these placeholders with your actual AWS details.
});

// Output the details of the RabbitMQ backend and the encryption key.
export const rabbitMqBackendPath = rabbitMqBackend.path;
export const encryptionKeyId = encryptionKey.id;
```

This program sets up a secure architecture for managing RabbitMQ credentials using HashiCorp Vault.

Here are some important notes:
- `connectionUri`, `username`, and `password` should be your RabbitMQ connection URI and management credentials. You should manage these secrets securely, not hard-code them into your program.
- Replace `KMS_KEY_ID_HERE`, `AWS_ACCESS_KEY_ID`, and `AWS_SECRET_ACCESS_KEY` placeholders with actual values. Best practices are to use environment variables or Pulumi's configuration system for sensitive data.
- `rabbitMqBackend.path` and `encryptionKey.id` are exported to be accessed outside the program, like in a CI/CD system or for reference in other Pulumi stacks.

This code sets up the Vault backend and key management using Pulumi, seamlessly integrating into your infrastructure as code workflow. It's important that access to Vault and AWS is properly secured and that permissions are minimized according to the principle of least privilege.