Step-by-Step Guide to Implementing Least Privilege Access with AWS IAM Roles and HashiCorp Vault 1.16

terraform {
  required_version = ">= 1.7.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    vault = {
      source  = "hashicorp/vault"
      version = "~> 3.12.0"
    }
  }
}

provider "aws" {
  region = var.aws_region
}

provider "vault" {
  address = var.vault_addr
}

variable "aws_region" {
  type        = string
  default     = "us-east-1"
  description = "AWS region to deploy resources to"
}

variable "vault_addr" {
  type        = string
  description = "Address of the Vault instance (e.g., https://vault.example.com:8200)"
}

variable "environment" {
  type        = string
  default     = "prod"
  description = "Deployment environment (prod, staging, dev)"
}

# Create IAM Role for Vault EC2 Instance
resource "aws_iam_role" "vault_ec2_role" {
  name = "${var.environment}-vault-ec2-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Environment = var.environment
    ManagedBy   = "terraform"
    Purpose     = "Vault EC2 Instance Role"
  }
}

# Attach least privilege policy to Vault EC2 Role
resource "aws_iam_role_policy_attachment" "vault_ec2_iam_readonly" {
  role       = aws_iam_role.vault_ec2_role.name
  policy_arn = "arn:aws:iam::aws:policy/IAMReadOnlyAccess"
}

# Create IAM Roles Anywhere Trust Anchor for Vault
resource "aws_iam_roles_anywhere_trust_anchor" "vault_trust_anchor" {
  name    = "${var.environment}-vault-trust-anchor"
  enabled = true

  source {
    source_type = "AWS_CERTIFICATE"
    # Use Vault's TLS certificate for trust
    certificate_authority_arn = aws_acm_certificate.vault_ca.arn
  }

  tags = {
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}

# Create ACM Certificate for Vault TLS
resource "aws_acm_certificate" "vault_ca" {
  private_key       = file("${path.module}/certs/vault-ca.key")
  certificate_body  = file("${path.module}/certs/vault-ca.crt")
  certificate_chain = file("${path.module}/certs/vault-ca-chain.crt")

  tags = {
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}

# Create CloudTrail for IAM and Vault audit logging
resource "aws_cloudtrail" "vault_iam_audit" {
  name                          = "${var.environment}-vault-iam-cloudtrail"
  s3_bucket_name                = aws_s3_bucket.cloudtrail_logs.id
  include_global_service_events = true
  is_multi_region_trail         = true

  event_selector {
    read_write_type           = "All"
    include_management_events = true

    data_resource {
      type   = "AWS::IAM::Role"
      values = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.environment}-*"]
    }
  }

  tags = {
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}

resource "aws_s3_bucket" "cloudtrail_logs" {
  bucket = "${var.environment}-vault-iam-cloudtrail-logs-${data.aws_caller_identity.current.account_id}"
}

data "aws_caller_identity" "current" {}

output "vault_ec2_role_arn" {
  value = aws_iam_role.vault_ec2_role.arn
}

output "iam_roles_anywhere_trust_anchor_arn" {
  value = aws_iam_roles_anywhere_trust_anchor.vault_trust_anchor.arn
}

#!/bin/bash
set -euo pipefail
IFS=$'\n\t'

# Configuration variables
VAULT_VERSION="1.16.0"
AWS_REGION="us-east-1"
VAULT_ADDR="https://vault.example.com:8200"
CERT_DIR="/etc/vault/certs"
CONFIG_DIR="/etc/vault/config"
DATA_DIR="/var/lib/vault"
LOG_DIR="/var/log/vault"

# Error handling function
error_exit() {
  echo "ERROR: $1" >&2
  exit 1
}

# Check if running as root
if [[ $EUID -ne 0 ]]; then
  error_exit "This script must be run as root"
fi

# Install dependencies
echo "Installing dependencies..."
apt-get update -y || error_exit "Failed to update apt"
apt-get install -y curl wget unzip jq awscli || error_exit "Failed to install dependencies"

# Download and install Vault 1.16.0
echo "Downloading Vault ${VAULT_VERSION}..."
wget -q "https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip" -O /tmp/vault.zip || error_exit "Failed to download Vault"
unzip -o /tmp/vault.zip -d /usr/local/bin/ || error_exit "Failed to unzip Vault"
chmod +x /usr/local/bin/vault
vault version || error_exit "Vault installation failed"

# Create Vault directories
echo "Creating Vault directories..."
mkdir -p "${CERT_DIR}" "${CONFIG_DIR}" "${DATA_DIR}" "${LOG_DIR}"
chown -R vault:vault "${CERT_DIR}" "${CONFIG_DIR}" "${DATA_DIR}" "${LOG_DIR}" 2>/dev/null || useradd -r -d "${DATA_DIR}" vault || error_exit "Failed to create vault user"

# Fetch TLS certificates from AWS ACM (assumes cert is pre-uploaded)
echo "Fetching Vault TLS certificates..."
aws acm get-certificate --certificate-arn "arn:aws:acm:${AWS_REGION}:${AWS_ACCOUNT_ID}:certificate/vault-ca" --region "${AWS_REGION}" | jq -r '.Certificate' > "${CERT_DIR}/vault.crt" || error_exit "Failed to fetch TLS certificate"
aws acm get-certificate --certificate-arn "arn:aws:acm:${AWS_REGION}:${AWS_ACCOUNT_ID}:certificate/vault-ca" --region "${AWS_REGION}" | jq -r '.CertificateChain' > "${CERT_DIR}/vault-chain.crt" || error_exit "Failed to fetch certificate chain"
aws acm export-certificate --certificate-arn "arn:aws:acm:${AWS_REGION}:${AWS_ACCOUNT_ID}:certificate/vault-ca" --region "${AWS_REGION}" | jq -r '.PrivateKey' > "${CERT_DIR}/vault.key" || error_exit "Failed to fetch private key"
chmod 600 "${CERT_DIR}/vault.key"
chown vault:vault "${CERT_DIR}/*"

# Write Vault configuration file
echo "Writing Vault configuration..."
cat > "${CONFIG_DIR}/vault.hcl" << EOF
storage "file" {
  path = "${DATA_DIR}"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_cert_file = "${CERT_DIR}/vault.crt"
  tls_key_file  = "${CERT_DIR}/vault.key"
  tls_client_ca_file = "${CERT_DIR}/vault-chain.crt"
}

# Enable IAM auth method (Vault 1.16 feature)
auth "iam" {
  enabled = true
  iam_server_id_header_required = true
}

# Enable audit logging to CloudTrail
audit "file" {
  file_path = "${LOG_DIR}/vault-audit.log"
  log_raw = true
}

# Enable telemetry for monitoring
telemetry {
  statsd_address = "localhost:8125"
  disable_hostname = false
}
EOF

chown vault:vault "${CONFIG_DIR}/vault.hcl"
chmod 600 "${CONFIG_DIR}/vault.hcl"

# Create systemd service for Vault
echo "Creating Vault systemd service..."
cat > /etc/systemd/system/vault.service << EOF
[Unit]
Description="HashiCorp Vault 1.16"
Documentation=https://www.vaultproject.io/docs/
Requires=network-online.target
After=network-online.target

[Service]
User=vault
Group=vault
ExecStart=/usr/local/bin/vault server -config="${CONFIG_DIR}/vault.hcl"
ExecReload=/bin/kill -HUP \$MAINPID
KillMode=process
Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
EOF

# Initialize and unseal Vault (production would use auto-unseal via AWS KMS)
echo "Initializing Vault..."
export VAULT_ADDR="${VAULT_ADDR}"
vault operator init -key-shares=3 -key-threshold=2 > "${DATA_DIR}/vault-init.txt" || error_exit "Vault initialization failed"
echo "Unsealing Vault..."
vault operator unseal "$(grep 'Unseal Key 1:' "${DATA_DIR}/vault-init.txt" | awk '{print \$4}')"
vault operator unseal "$(grep 'Unseal Key 2:' "${DATA_DIR}/vault-init.txt" | awk '{print \$4}')"

# Enable IAM auth method (redundant but explicit for 1.16)
vault auth enable iam || error_exit "Failed to enable IAM auth"

echo "Vault 1.16 installation complete. Root token: $(grep 'Initial Root Token:' "${DATA_DIR}/vault-init.txt" | awk '{print \$4}')"

package main

import (
    "context"
    "fmt"
    "log"
    "os"

    "github.com/aws/aws-sdk-go-v2/aws"
    "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/service/iam"
    "github.com/aws/aws-sdk-go-v2/service/iamrolesanywhere"
    "github.com/aws/aws-sdk-go-v2/service/iamrolesanywhere/types"
    "github.com/hashicorp/vault/api"
)

const (
    vaultAddr       = "https://vault.example.com:8200"
    awsRegion       = "us-east-1"
    trustAnchorName = "vault-prod-trust-anchor"
    iamRoleName     = "vault-dynamic-s3-readonly"
    policyArn       = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
)

func main() {
    ctx := context.Background()

    // Initialize Vault client
    vaultClient, err := api.NewClient(&api.Config{Address: vaultAddr})
    if err != nil {
        log.Fatalf("Failed to create Vault client: %v", err)
    }
    // Use root token for initial setup (replace with IAM auth in production)
    vaultClient.SetToken(os.Getenv("VAULT_ROOT_TOKEN"))
    if vaultClient.Token() == "" {
        log.Fatal("VAULT_ROOT_TOKEN environment variable is not set")
    }

    // Configure AWS SDK
    awsCfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(awsRegion))
    if err != nil {
        log.Fatalf("Failed to load AWS config: %v", err)
    }
    iraClient := iamrolesanywhere.NewFromConfig(awsCfg)

    // 1. Create IAM Role for dynamic S3 access
    createIAMRole(ctx, awsCfg)

    // 2. Create IAM Roles Anywhere Trust Anchor
    trustAnchorArn := createTrustAnchor(ctx, iraClient, awsCfg)

    // 3. Create IAM Roles Anywhere Profile
    createProfile(ctx, iraClient, trustAnchorArn)

    // 4. Configure Vault AWS Secret Backend
    configureVaultAWSBackend(ctx, vaultClient, trustAnchorArn)

    fmt.Println("IAM Roles Anywhere and Vault configuration complete.")
}

// createIAMRole creates a least privilege IAM role for S3 readonly access
func createIAMRole(ctx context.Context, cfg aws.Config) {
    iamClient := iam.NewFromConfig(cfg)
    assumeRolePolicy := `{
        "Version": "2012-10-17",
        "Statement": [{
            "Effect": "Allow",
            "Principal": {"Service": "rolesanywhere.amazonaws.com"},
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {"aws:RequestedRegion": "us-east-1"}
            }
        }]
    }`

    _, err := iamClient.CreateRole(ctx, &iam.CreateRoleInput{
        RoleName:                 aws.String(iamRoleName),
        AssumeRolePolicyDocument: aws.String(assumeRolePolicy),
        Description:              aws.String("Least privilege role for dynamic S3 readonly access via Vault"),
    })
    if err != nil {
        // Ignore if role already exists
        if _, ok := err.(*types.EntityAlreadyExistsException); ok {
            log.Printf("IAM role %s already exists, skipping creation", iamRoleName)
        } else {
            log.Fatalf("Failed to create IAM role: %v", err)
        }
    }

    // Attach S3 readonly policy
    _, err = iamClient.AttachRolePolicy(ctx, &iam.AttachRolePolicyInput{
        RoleName:  aws.String(iamRoleName),
        PolicyArn: aws.String(policyArn),
    })
    if err != nil {
        log.Fatalf("Failed to attach policy to IAM role: %v", err)
    }
    log.Printf("Created IAM role %s with policy %s", iamRoleName, policyArn)
}

// createTrustAnchor creates an IAM Roles Anywhere trust anchor for Vault
func createTrustAnchor(ctx context.Context, client *iamrolesanywhere.Client, cfg aws.Config) string {
    acmClient := acm.NewFromConfig(cfg)
    // Fetch Vault's CA certificate ARN from Terraform output
    caArn := os.Getenv("VAULT_CA_ARN")
    if caArn == "" {
        log.Fatal("VAULT_CA_ARN environment variable is not set")
    }

    output, err := client.CreateTrustAnchor(ctx, &iamrolesanywhere.CreateTrustAnchorInput{
        Name:    aws.String(trustAnchorName),
        Enabled: aws.Bool(true),
        Source: &types.Source{
            SourceType: types.SourceTypeAwsCertificate,
            AwsCertificateSource: &types.AwsCertificateSource{
                CertificateAuthorityArn: aws.String(caArn),
            },
        },
    })
    if err != nil {
        log.Fatalf("Failed to create trust anchor: %v", err)
    }
    log.Printf("Created trust anchor: %s", *output.TrustAnchor.TrustAnchorArn)
    return *output.TrustAnchor.TrustAnchorArn
}

// createProfile creates an IAM Roles Anywhere profile linked to the trust anchor
func createProfile(ctx context.Context, client *iamrolesanywhere.Client, trustAnchorArn string) {
    output, err := client.CreateProfile(ctx, &iamrolesanywhere.CreateProfileInput{
        Name:            aws.String("vault-s3-profile"),
        RoleArns:        []string{fmt.Sprintf("arn:aws:iam::%s:role/%s", os.Getenv("AWS_ACCOUNT_ID"), iamRoleName)},
        TrustAnchorArns: []string{trustAnchorArn},
    })
    if err != nil {
        log.Fatalf("Failed to create profile: %v", err)
    }
    log.Printf("Created profile: %s", *output.Profile.ProfileArn)
}

// configureVaultAWSBackend sets up Vault's AWS secret backend with IAM Roles Anywhere
func configureVaultAWSBackend(ctx context.Context, client *api.Client, trustAnchorArn string) {
    // Enable AWS secret backend
    err := client.Sys().EnableSecretsEngine("aws", &api.EnableSecretsEngineInput{
        Path: "aws",
    })
    if err != nil {
        log.Fatalf("Failed to enable AWS backend: %v", err)
    }

    // Configure AWS backend with IAM Roles Anywhere
    _, err = client.Logical().Write("aws/config/root", map[string]interface{}{
        "iam_roles_anywhere_arn": trustAnchorArn,
        "region":                 awsRegion,
    })
    if err != nil {
        log.Fatalf("Failed to configure AWS backend: %v", err)
    }
    log.Printf("Configured Vault AWS backend with IAM Roles Anywhere")
}

import os
import boto3
import hvac
from hvac.exceptions import VaultError
from botocore.exceptions import ClientError

# Configuration
VAULT_ADDR = "https://vault.example.com:8200"
VAULT_ROLE = "s3-readonly"
AWS_REGION = "us-east-1"
TEST_BUCKET = "vault-least-privilege-test-bucket"

def authenticate_to_vault():
    """Authenticate to Vault using IAM auth method (Vault 1.16 feature)"""
    try:
        # Use IAM auth: Vault validates the caller's IAM identity
        client = hvac.Client(url=VAULT_ADDR)
        # IAM auth requires the role name and the IAM identity's STS token
        # For EC2 instances, this uses the instance profile's IAM role automatically
        response = client.auth.iam.login(
            role=VAULT_ROLE,
            use_token=True
        )
        print(f"Successfully authenticated to Vault as role {VAULT_ROLE}")
        return client
    except VaultError as e:
        raise RuntimeError(f"Vault authentication failed: {e}")

def generate_dynamic_aws_credentials(vault_client):
    """Generate short-lived AWS credentials via Vault's AWS secret backend"""
    try:
        # Generate new credentials
        creds = vault_client.secrets.aws.generate_credentials(
            name=VAULT_ROLE,
            ttl="15m"  # Credentials valid for 15 minutes
        )
        print(f"Generated dynamic AWS credentials, valid for 15 minutes")
        return creds["data"]
    except VaultError as e:
        raise RuntimeError(f"Failed to generate AWS credentials: {e}")

def test_s3_access(aws_creds):
    """Test that the dynamic credentials only have S3 readonly access"""
    try:
        # Create boto3 session with dynamic credentials
        session = boto3.Session(
            aws_access_key_id=aws_creds["access_key"],
            aws_secret_access_key=aws_creds["secret_key"],
            aws_session_token=aws_creds["security_token"],
            region_name=AWS_REGION
        )
        s3_client = session.client("s3")

        # Test allowed action: List bucket (should succeed)
        response = s3_client.list_objects_v2(Bucket=TEST_BUCKET, MaxKeys=1)
        print(f"Successfully listed objects in {TEST_BUCKET}: {response.get('KeyCount', 0)} objects")

        # Test disallowed action: Put object (should fail)
        try:
            s3_client.put_object(
                Bucket=TEST_BUCKET,
                Key="test-least-privilege.txt",
                Body=b"test"
            )
            raise AssertionError("PutObject succeeded, which violates least privilege!")
        except ClientError as e:
            if e.response["Error"]["Code"] == "403":
                print("PutObject correctly denied (403 Forbidden) - least privilege enforced")
            else:
                raise
        return True
    except ClientError as e:
        raise RuntimeError(f"S3 access test failed: {e}")

def main():
    try:
        # Step 1: Authenticate to Vault
        vault_client = authenticate_to_vault()

        # Step 2: Generate dynamic AWS credentials
        aws_creds = generate_dynamic_aws_credentials(vault_client)

        # Step 3: Test least privilege S3 access
        test_s3_access(aws_creds)

        print("All tests passed! Least privilege access is correctly configured.")
    except RuntimeError as e:
        print(f"Test failed: {e}")
        exit(1)

if __name__ == "__main__":
    main()

vault write aws/roles/s3-readonly \
  policy=@s3-readonly-policy.json \
  validate=true \
  ttl=15m \
  max_ttl=1h

aws access-analyzer create-analyzer \
  --analyzer-name vault-iam-analyzer \
  --type ACCOUNT \
  --region us-east-1 \
  --tags Environment=prod,ManagedBy=terraform

resource "vault_aws_secret_backend_role" "s3_readonly" {
  backend      = "aws"
  name         = "s3-readonly"
  policy       = file("${path.module}/policies/s3-readonly.json")
  validate     = true
  ttl          = "15m"
  max_ttl      = "1h"
  tags = {
    owner       = "backend-team"
    environment = "prod"
  }
}

aws-vault-least-privilege-2024/
├── terraform/
│   ├── main.tf
│   ├── variables.tf
│   ├── outputs.tf
│   └── certs/
│       ├── vault-ca.crt
│       ├── vault-ca.key
│       └── vault-ca-chain.crt
├── scripts/
│   ├── install-vault-1.16.sh
│   └── test-dynamic-creds.py
├── go/
│   ├── cmd/
│   │   └── setup-iam-roles-anywhere/
│   │       └── main.go
│   ├── go.mod
│   └── go.sum
├── policies/
│   ├── s3-readonly.json
│   └── iam-roles-anywhere-trust.json
└── README.md