Scan Amazon EC2 for secrets

Connect Amazon Elastic Compute Cloud (EC2) as a data source to HCP Vault Radar to scan your Amazon EC2 instances for sensitive data and secrets.

If you are new to HCP Vault Radar, checkout the HCP Vault Radar quickstart tutorial series.

Prerequisites

To establish a connection, you need the following:

• An AWS account with one or more running Amazon EC2 instances.

• An authentication method for Vault Radar to access your AWS account. You can use either of the following:

  • An IAM role that Vault Radar can assume (recommended).
  • AWS credentials (access key ID and secret access key) provided through environment variables.

• Each Amazon EC2 instance you want to scan must have an IAM instance profile with the arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore policy attached, and the SSM agent must be installed and running. Vault Radar scans instances by creating a temporary AMI, launching a scanner instance using that AMI, and running scan commands on it via SSM.

• An IAM policy attached to the role or user that grants the permissions Vault Radar needs to discover and scan Amazon EC2 instances:

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "sts:GetCallerIdentity",
                  "ec2:DescribeRegions",
                  "ec2:DescribeInstances",
                  "ec2:CreateImage",
                  "ec2:DescribeImages",
                  "ec2:DeregisterImage",
                  "ec2:DeleteSnapshot",
                  "ec2:RunInstances",
                  "ec2:TerminateInstances",
                  "ssm:SendCommand",
                  "ssm:GetCommandInvocation",
                  "ssm:DescribeInstanceInformation",
                  "ssm:PutParameter",
                  "ssm:DeleteParameter"
              ],
              "Resource": "*"
          }
      ]
  }
  

  Refer to AWS Authentication for more information about the available authentication methods.

Add an AWS Amazon EC2 data source

1. Log into the HCP Portal with an HCP IAM user that has the HCP owner or admin role.

2. Click Vault Radar.

3. Click Settings.

4. Click Data Sources.

5. Select HCP Vault Radar Agent Scan.

6. Click on the AWS EC2 button.

7. Select an authentication method from the Select authentication method dropdown:

   • IAM Role (Recommended)
   • AWS Credentials from environment variable

8. Provide the credentials for the selected authentication method:

   • If you selected IAM Role (Recommended), optionally enter an IAM role ARN in the Assume role ARN field for cross-account access or elevated permissions. For example, arn:aws:iam::123456789012:role/role-name.

   • If you selected AWS Credentials from environment variable, choose whether to use the default environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY). To use different variables, clear Use default environment variables and enter the environment variable references in the AWS Access Key ID and AWS Secret Access Key fields, for example, env://AWS_ACCESS_KEY_ID. Optionally, enter an Assume role ARN if Vault Radar should assume a role after authenticating with the provided credentials.

9. Click Next.

10. Select either All active instances or Select instances to monitor.

11. Click Finish to start onboarding and scanning the selected instances.

Assign a group to a resource

Once you add a data source, an HCP user with the admin role must assign a group to each of the monitored resources within each data source. You can assign each resource to only one group.

If you do not already have a group, refer to the Identity and Access Management groups documentation to create a group.

1. Navigate to the Project dashboard.

2. Click Access control (IAM).

3. Click Add new assignment.

4. Search the name of the group in the Search for an assignee search field.

5. Click the group name in the search results.

6. Click the Select service pulldown menu and select Vault Radar.

7. Click the Select role pulldown menu and select the Vault Radar Developer role.

8. Click Save.

9. Click Back to Dashboard.

10. Click Vault Radar.

11. Click Resources.

12. Select the resource you want to assign to a group and click Assign groups.

13. Click the Assign resoruce to group pulldown menu.

14. Select the group that requires access to the resource.

15. Select either the Viewer or Contributor role.

16. Click OK.

Update data source

1. Navigate to Settings.

2. Click Data Sources

3. Click the vertical ellipsis to the right of the data source..

4. To update the monitored data sources, click Edit data sources.

5. To update the token, click Edit data source host details.

6. To delete the data source host, click Delete data source host.

Tutorials

Learn how to evaluate and implement HCP Vault Radar in your environment with our tutorials.

• HCP Vault Radar quickstart - Follow HashiCups, a fictitious coffee company, as they onboard HCP Vault Radar and scan their data sources for secrets.
• HCP Vault Radar operations - Learn how HashiCups operations team uses HCP Vault Radar advanced features to scan data sources with the Vault Radar agent, and correlates findings with HCP Vault to manage secrets.
• HCP Vault Radar developer - Learn how HashiCups developers use HCP Vault Radar advanced features to understand secret exposure, identify potential risks, and prevent leaked secrets during the software development lifecycle.