Encrypting data with Vault Transit before storing in a database

Question

Pulumi · Accepted Answer

## Using HashiCorp Vault's Transit Secrets Engine with Pulumi

HashiCorp Vault's Transit Secrets Engine provides encryption as a service, allowing you to easily encrypt and decrypt data without handling cryptographic keys directly. The engine is set up in Vault, and once it's in place, you can use it to secure your sensitive data before storing it in the database.

To accomplish this with Pulumi, we'll break the task into several steps:
1. Configure the Vault provider.
2. Set up the Transit Secrets Engine.
3. Create an encryption key that will be used by the Transit Engine.
4. Optionally, you can then integrate the flow into the process of storing data in a database.

Let's write a Pulumi program in TypeScript that achieves the above steps.

### Step 1: Configure the Vault Provider

Make sure you have Vault installed and properly configured. This includes having the necessary access credentials and endpoint URL. Pulumi will use the Vault provider to interact with your Vault instance.

### Step 2: Set up the Transit Secrets Engine

We will enable the Transit Secrets Engine on a specified path within Vault. This is where we'll create our encryption keys and perform encrypt/decrypt operations.

### Step 3: Create an Encryption Key

We'll need to create an encryption key in the Transit Secrets Engine. This is the key that will be used to encrypt and decrypt the data.

### The Program

Below is a Pulumi TypeScript program that sets up the Vault Transit Secrets Engine and creates an encryption key.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

// Step 2: Set up the Transit Secrets Engine
const transitSecretsEngine = new vault.Mount("transit", {
    path: "transit", // This is where the secrets engine will be enabled
    type: "transit",
    description: "Transit Secrets Engine for encryption/decryption",
});

// Step 3: Create an Encryption Key
const encryptionKey = new vault.transit.SecretBackendKey("encryption-key", {
    backend: transitSecretsEngine.path,
    name: "my-encryption-key", // The name of the encryption key
    deletionAllowed: true, // Set to true to allow deletion of the key
});

// Since we are not integrating it with an actual database in this example,
// this would be the part where you'd take the `encryptionKey.name` and
// integrate it into your data flow, using Vault's encrypt/decrypt API
// endpoints to secure your data before it's stored in the database.

export const keyName = encryptionKey.name; // Export the name of the key
export const transitPath = transitSecretsEngine.path; // Export the transit path
```

In the code above:
- We import the `@pulumi/vault` package which contains the necessary resources to interact with Vault.
- We create a `Mount` resource, which enables the Transit Secrets Engine at the specified path within Vault.
- We then create a `SecretBackendKey` resource, which is essentially our encryption key. This key will be used for our encryption and decryption operations.

The exported `keyName` and `transitPath` can be used to reference the encryption key and transit path respectively in other Pulumi resources or in your application code when performing encrypt/decrypt operations through Vault's API.

Keep in mind that for a full production implementation, you'll need more robust handling around secret management, key rotation, and other cybersecurity best practices. This program assumes that your Pulumi and Vault configuration are already set up and that the Transit Secrets Engine is not already enabled on the path "transit" in your Vault.

After setting this up, you can follow Vault's documentation to see how to use the Transit Secrets Engine to encrypt and decrypt data via Vault's API, which you would then be able to send to your database securely.

Remember to check the official [Pulumi Vault Provider documentation](https://www.pulumi.com/registry/packages/vault/api-docs/) and the [Vault Transit Secrets Engine documentation](https://www.vaultproject.io/docs/secrets/transit) for more information on how to use these resources and secure your secrets management workflow.