From 10c8db9f62504a982d711d2e822eb086e1945f66 Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Mon, 12 Jun 2023 13:45:15 -0400 Subject: [PATCH 01/18] Tech Partner Hashicorp Transit Secrets Engine Guide --- .../02-PartnerInformation.mdx | 12 ++++++++++++ .../03-SolutionSummary.mdx | 0 .../04-ConfiguringTransitSecretsEngine.mdx | 0 .../05-UsingTransitSecretsEngine.mdx | 0 .../06-CertificationEnvironment.mdx | 0 .../07-Support.mdx | 0 .../Images/PartnerProgram.jpg.png | 3 +++ .../HashicorpVaultTransitSecretsEngine/index.mdx | 14 ++++++++++++++ 8 files changed, 29 insertions(+) create mode 100644 advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx create mode 100644 advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx create mode 100644 advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx create mode 100644 advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx create mode 100644 advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/06-CertificationEnvironment.mdx create mode 100644 advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/07-Support.mdx create mode 100644 advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/PartnerProgram.jpg.png create mode 100644 advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/index.mdx diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx new file mode 100644 index 00000000000..04f70cb31b7 --- /dev/null +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx @@ -0,0 +1,12 @@ +--- +title: 'Partner Information' +description: 'Details of the Partner' + +--- +|   |   | +| ----------- | ----------- | +| **Partner Name** | Hashicorp | +| **Web Site** | https://www.hashicorp.com/ | +| **Partner Product** | Vault | +| **Version** | Vault v1.13.3 | +| **Product Description** | Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server, it allows users to control access to encryption keys and certificates, as well as perform key management. | \ No newline at end of file diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx new file mode 100644 index 00000000000..e69de29bb2d diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx new file mode 100644 index 00000000000..e69de29bb2d diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx new file mode 100644 index 00000000000..e69de29bb2d diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/06-CertificationEnvironment.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/06-CertificationEnvironment.mdx new file mode 100644 index 00000000000..e69de29bb2d diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/07-Support.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/07-Support.mdx new file mode 100644 index 00000000000..e69de29bb2d diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/PartnerProgram.jpg.png b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/PartnerProgram.jpg.png new file mode 100644 index 00000000000..93e0514710b --- /dev/null +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/PartnerProgram.jpg.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:1953f3a5526ab37279a598f1c370c5acbf9f6d18f7902cb538161182fbed3b1f +size 57295 diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/index.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/index.mdx new file mode 100644 index 00000000000..d18e5885d50 --- /dev/null +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/index.mdx @@ -0,0 +1,14 @@ +--- +title: 'Hashicorp Transit Secrets Engine Implementation Guide' +indexCards: simple +directoryDefaults: + iconName: handshake +--- + +

+ +

+

EDB GlobalConnect Technology Partner Implementation Guide

+

Hashicorp Transit Secrets Engine

+ +

This document is intended to augment each vendor’s product documentation in order to guide the reader in getting the products working together. It is not intended to show the optimal configuration for the certified integration.

\ No newline at end of file From 761a45412e1ee2d81b893bcbcef8dc0c58e6ff54 Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Thu, 15 Jun 2023 12:57:46 -0400 Subject: [PATCH 02/18] Tech Partner Hashicorp Vault Transit Secrets Engine Guide --- .../02-PartnerInformation.mdx | 2 +- .../03-SolutionSummary.mdx | 11 + .../04-ConfiguringTransitSecretsEngine.mdx | 61 +++++ .../05-UsingTransitSecretsEngine.mdx | 217 ++++++++++++++++++ .../06-CertificationEnvironment.mdx | 11 + .../07-Support.mdx | 22 ++ 6 files changed, 323 insertions(+), 1 deletion(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx index 04f70cb31b7..3e9395aaa07 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx @@ -9,4 +9,4 @@ description: 'Details of the Partner' | **Web Site** | https://www.hashicorp.com/ | | **Partner Product** | Vault | | **Version** | Vault v1.13.3 | -| **Product Description** | Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server, it allows users to control access to encryption keys and certificates, as well as perform key management. | \ No newline at end of file +| **Product Description** | Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server and EDB Postgres Extended Server, it allows users to control access to encryption keys and certificates, as well as perform key management. | \ No newline at end of file diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx index e69de29bb2d..633c405ff60 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx @@ -0,0 +1,11 @@ +--- +title: 'Solution Summary' +description: 'Explanation of the solution and its purpose' +--- + +Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server versions 15.2 and above or EDB Postgres Extended Server versions 15 and above, it allows users to control access to encryption keys and certificates, as well as perform key management. Using Hashicorp Vault’s Transit secrets engine allows Vault to handle cryptographic functions on data in-transit. Hashicorp Vault Transit secrets engine can be referred to as "encryption as a service". + +Hashicorp Vault’s primary use case for Transit secrets engine is to encrypt data from applications while simultaneously storing encrypted data in some primary data store. Hashicorp Vault Transit Secrets Engine can also generate hashes, sign and verify data and generate HMAC' of data. + +![Hashicorp Vault Transit Secrets Engine Architecture](Images/HashicorpVaultTransitSecretsEngineArchitecture.png) + diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx index e69de29bb2d..937a348706e 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx @@ -0,0 +1,61 @@ +--- +title: 'Configuration' +description: 'Walkthrough on configuring the integration' +--- + +Implementing Hashicorp Vault with EDB Postgres Advanced Server version 15.2 and above, requires the following components: + +- EDB Postgres Advanced Server version 15.2 or above +- Hashicorp Vault v1.13.3 +- [Pykmip](https://pypi.org/project/PyKMIP/#files) +- Python + +## Prerequisites + +- A running EDB Postgres Advanced Server instance +- Hashicorp Vault installed and deployed per your VM environment + +## Enable Hashicorp Vault Transit Secrets Engine + +!!! Note + You have to set your environment variable with Hashicorp Vault. If you receive this error message “Get "https://127.0.0.1:8200/v1/sys/seal-status": http: server gave HTTP response to HTTPS client” you need to issue this in your command line `export VAULT_ADDR="http://127.0.0.1:8200`". + +1. After your Hashicorp Vault configuration is installed and deployed per the guidelines in the [Hashicorp documentation](https://developer.hashicorp.com/vault/tutorials/getting-started/getting-started-install), you will then need to enable the transit secrets engine. + +2. Assume root user. + +3. First set your two variables, your API address and token you receieved during installation and setup. +```bash +root@ip-172-31-50-151:/home/ubuntu# export VAULT_ADDR='http://127.0.0.1:8200' +root@ip-172-31-50-151:/home/ubuntu# export VAULT_TOKEN="hvs.D9lfoRBZYtdJY2t3lG3f6yUa" +``` +4. Before you enable the Transit Secrets Engine you can check your Vault Server status with `vault status` +```bash +root@ip-172-31-50-151:/home/ubuntu# vault status +Key Value +--- ----- +Seal Type shamir +Initialized true +Sealed false +Total Shares 1 +Threshold 1 +Version 1.13.3 +Build Date 2023-06-06T18:12:37Z +Storage Type inmem +Cluster Name vault-cluster-18a7ed39 +Cluster ID 83012ee7-18f0-9480-e8b6-3ff02c285ba2 +HA Enabled false +``` + +5. Type `vault secrets enable transit`. +```bash +root@ip-172-31-50-151:/home/ubuntu# vault secrets enable transit +Success! Enabled the transit secrets engine at: transit/ +``` + +6. Next you will create your encryption key with an identifiable name. +```bash +root@ip-172-31-50-151:/usr/lib/edb-pge/15/bin# vault write -f transit/keys/pg-tde-master-1 +Success! Data written to: transit/keys/pg-tde-master-1 +``` +7. You now have your encryption key set and are ready to export your WRAP and UNWRAP commands and initialize your database. \ No newline at end of file diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx index e69de29bb2d..240d3b40fbf 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx @@ -0,0 +1,217 @@ +--- +title: 'Using' +description: 'Walkthrough of example usage scenarios' +--- + +After you have configured Hashicorp Vault Transit Secrets Engine as stated in the Configuring section, you will be able to then encrypt your EDB Postgres Advanced Server database. + +!!! Note + It is important to note that this doc is intended for versions 15.2 and above of EDB Postgres Advanced Server or versions 15 and above of EDB Postgres Extended Server as this version supports Transparent Data Encryption (TDE). + +After the Hashicorp Vault Transit secrets engine is configured and a user/machine has a Vault token with the proper permissions, this was configured during your install and setup of Transit Secrets Engine, it can use this secrets engine to encrypt a key. + +## Perform initdb for the Database + +After you have enabled Hashicorp Vault Transit Secrets Engine and created a key, you will be able to export the PGDATAKEYWRAPCMD and PGDATAKEYUNWRAPCMD to wrap and unwrap your encryption key and initialize your database. + +1. Login to your EDB Postgres Advanced Server system as the database superuser, for example `sudo su - enterprisedb`. + +2. Navigate to the `/bin` directory where your executables live. In our example it is `/usr/lib/edb-as/15/bin`. + +3. Type: `export PGDATAKEYWRAPCMD='base64 | vault write -field=ciphertext transit/encrypt/pg-tde-master-1 plaintext=- > %p'` + +4. Type: `export PGDATAKEYUNWRAPCMD='cat %p | vault write -field=plaintext transit/decrypt/pg-tde-master-1 ciphertext=- | base64 --decode'` + +```bash +root@ip-172-31-50-151:/usr/lib/edb-pge/15/bin# su - enterprisedb + +enterprisedb@ip-172-31-50-151:~$ export PGDATAKEYWRAPCMD='base64 | vault write -field=ciphertext transit/encrypt/pg-tde-master-1 plaintext=- > %p' + +enterprisedb@ip-172-31-50-151:~$ export PGDATAKEYUNWRAPCMD='cat %p | vault write -field=plaintext transit/decrypt/pg-tde-master-1 ciphertext=- | base64 --decode' +``` +5. Perform your initdb per your database requirements, for example: `./initdb -D dd12 -y`. + +6. If all is successful you should get an output that looks like this: +```bash + + enterprisedb@ip-172-31-46-134:/usr/lib/edb-as/15/bin$ ./initdb -D /var/lib/edb-as/15/dd12 -y +The files belonging to this database system will be owned by user "enterprisedb". +This user must also own the server process. +The database cluster will be initialized with locale "C.UTF-8". +The default database encoding has accordingly been set to "UTF8". +The default text search configuration will be set to "english". +Data page checksums are disabled. +Transparent data encryption is enabled. +creating directory /var/lib/edb-as/15/dd12 ... ok +creating subdirectories ... ok +selecting dynamic shared memory implementation ... posix +selecting default max_connections ... 100 +selecting default shared_buffers ... 128MB +selecting default time zone ... America/New_York +creating configuration files ... ok +setting up data encryption ... ok +running bootstrap script ... usage: edb_tde_kmip_client.py [-h] [--pykmip-config-file FILENAME] + [--pykmip-config-block NAME] + [--in-file FILENAME] [--out-file FILENAME] + --key-uid KEY_UID --variant {pykmip,thales} + {decrypt,encrypt} +edb_tde_kmip_client.py: error: argument --variant: invalid choice: 'pymip' (choose from 'pykmip', 'thales') +2023-04-12 09:35:27 EDT FATAL: unwrapped key is too small +child process exited with exit code 1 +initdb: removing data directory "/var/lib/edb-as/15/dd12" +enterprisedb@ip-172-31-46-134:/usr/lib/edb-as/15/bin$ export PGDATAKEYWRAPCMD='python3 /tmp/edb_tde_kmip_client.py encrypt --pykmip-config-file=/tmp/pykmip.conf --key-uid=nfTCV2Cp5sffhQuRrOVfgCUyu8qh9kwd --out-file=%p --variant=pykmip' +enterprisedb@ip-172-31-46-134:/usr/lib/edb-as/15/bin$ export PGDATAKEYUNWRAPCMD='python3 /tmp/edb_tde_kmip_client.py decrypt --pykmip-config-file=/tmp/pykmip.conf --key-uid=nfTCV2Cp5sffhQuRrOVfgCUyu8qh9kwd --in-file=%p --variant=pykmip' +enterprisedb@ip-172-31-46-134:/usr/lib/edb-as/15/bin$ +enterprisedb@ip-172-31-46-134:/usr/lib/edb-as/15/bin$ +enterprisedb@ip-172-31-46-134:/usr/lib/edb-as/15/bin$ +enterprisedb@ip-172-31-46-134:/usr/lib/edb-as/15/bin$ +enterprisedb@ip-172-31-46-134:/usr/lib/edb-as/15/bin$ ./initdb -D /var/lib/edb-as/15/dd12 -y +The files belonging to this database system will be owned by user "enterprisedb". +This user must also own the server process. +The database cluster will be initialized with locale "C.UTF-8". +The default database encoding has accordingly been set to "UTF8". +The default text search configuration will be set to "english". +Data page checksums are disabled. +Transparent data encryption is enabled. +creating directory /var/lib/edb-as/15/dd12 ... ok +creating subdirectories ... ok +selecting dynamic shared memory implementation ... posix +selecting default max_connections ... 100 +selecting default shared_buffers ... 128MB +selecting default time zone ... America/New_York +creating configuration files ... ok +setting up data encryption ... ok +running bootstrap script ... ok +performing post-bootstrap initialization ... ok +creating edb sys ... ok +loading edb contrib modules ... +edb_redwood_bytea.sql +edb_redwood_date.sql +dbms_alert_public.sql +dbms_alert.plb +dbms_job_public.sql +dbms_job.plb +dbms_lob_public.sql +dbms_lob.plb +dbms_output_public.sql +dbms_output.plb +dbms_pipe_public.sql +dbms_pipe.plb +dbms_rls_public.sql +dbms_rls.plb +dbms_sql_public.sql +dbms_sql.plb +dbms_utility_public.sql +dbms_utility.plb +dbms_aqadm_public.sql +dbms_aqadm.plb +dbms_aq_public.sql +dbms_aq.plb +dbms_profiler_public.sql +dbms_profiler.plb +dbms_random_public.sql +dbms_random.plb +dbms_redact_public.sql +dbms_redact.plb +dbms_lock_public.sql +dbms_lock.plb +dbms_scheduler_public.sql +dbms_scheduler.plb +dbms_crypto_public.sql +dbms_crypto.plb +dbms_mview_public.sql +dbms_mview.plb +dbms_session_public.sql +dbms_session.plb +edb_bulkload.sql +edb_gen.sql +edb_objects.sql +edb_redwood_casts.sql +edb_redwood_strings.sql +edb_redwood_views.sql +utl_encode_public.sql +utl_encode.plb +utl_http_public.sql +utl_http.plb +utl_file.plb +edb_ht_public.sql +edb_ht.plb +utl_tcp_public.sql +utl_tcp.plb +utl_smtp_public.sql +utl_smtp.plb +utl_mail_public.sql +utl_mail.plb +utl_url_public.sql +utl_url.plb +utl_raw_public.sql +utl_raw.plb +commoncriteria.sql +edb_gen_redwood.sql +waitstates.sql +installing extension edb_dblink_libpq ... ok +installing extension edb_dblink_oci ... ok +snap_tables.sql +snap_functions.sql +dblink_ora.sql +sys_stats.sql +ok +finalizing initial databases ... ok +syncing data to disk ... ok +initdb: warning: enabling "trust" authentication for local connections +initdb: hint: You can change this by editing pg_hba.conf or using the option -A, or --auth-local and --auth-host, the next time you run initdb. +Success. You can now start the database server using: + pg_ctl -D /var/lib/edb-as/15/dd12 -l logfile start + +``` + +7. Start your database and navigate to your `/data` directory to view the postgresql.conf file to ensure that your `data_encryption_key_unwrap_command` that you set with your `export PGDATAUNWRAPCMD` is present under the Authentication section. +```bash +# - Authentication - + +#authentication_timeout = 1min # 1s-600s +#password_encryption = scram-sha-256 # scram-sha-256 or md5 +#db_user_namespace = off + +# GSSAPI using Kerberos +#krb_server_keyfile = 'FILE:${sysconfdir}/krb5.keytab' +#krb_caseins_users = off + +# - SSL - + +#ssl = off +#ssl_ca_file = '' +#ssl_cert_file = 'server.crt' +#ssl_crl_file = '' +#ssl_crl_dir = '' +#ssl_key_file = 'server.key' +#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers +#ssl_prefer_server_ciphers = on +#ssl_ecdh_curve = 'prime256v1' +#ssl_min_protocol_version = 'TLSv1.2' +#ssl_max_protocol_version = '' +#ssl_dh_params_file = '' +#ssl_passphrase_command = '' +#ssl_passphrase_command_supports_reload = off + +# - Data Encryption - + +data_encryption_key_unwrap_command = 'cat %p | vault write -field=plaintext transit/decrypt/pg-tde-master-1 ciphertext=- | base64 --decode' + +``` +## Encrypt Plaintext Data + +Hashicorp Vault Transit Secrets Engine can also encrypt some plaintext data. However any plaintext data needs to be base64-encoded. This is a requirement as Hashicorp Vault does not require that the plaintext data is "text", it could also be another type of file. + +```bash +enterprisedb@ip-172-31-50-151:~$ export VAULT_TOKEN="hvs.D9lfoRBZYtdJY2t3lG3f6yUa" +enterprisedb@ip-172-31-50-151:~$ vault write transit/encrypt/pg-tde-master-1 plaintext=$(echo "my secret data" | base64) +Key Value +--- ----- +ciphertext vault:v1:/laUa+i1RVs4kFDD+a6Dmm+mJvVuo8jW0JHWISlzEe/ur/nUlfswEyYShA== +key_version 1 +``` +As an added note, Hashicorp Vault does not store any data, that is up to the database user. For any more information on Hashicorp Vault Transit Secrets Engine visit the [Hashicorp](https://developer.hashicorp.com/vault/docs/secrets/transit) documentation. + +For more information on how TDE is incorporated with EDB Postgres Advanced Server visit the [EDB Transparent Data Encryption](https://www.enterprisedb.com/docs/tde/latest/) documentation. + diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/06-CertificationEnvironment.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/06-CertificationEnvironment.mdx index e69de29bb2d..e03cc996f9b 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/06-CertificationEnvironment.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/06-CertificationEnvironment.mdx @@ -0,0 +1,11 @@ +--- +title: 'Certification Environment' +description: 'Overview of the certification environment' +--- + +|   |   | +| ----------- | ----------- | +| **Certification Test Date** | June 12, 2023 | +| **EDB Postgres Advanced Server** | 15.2 | +| **EDB Postgres Extended Server** | 15 | +| **Hashicorp Vault** | v1.13.3 | \ No newline at end of file diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/07-Support.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/07-Support.mdx index e69de29bb2d..1c36ee14f88 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/07-Support.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/07-Support.mdx @@ -0,0 +1,22 @@ +--- +title: 'Support and Logging Details' +description: 'Details of the support process and logging information' +--- + +## Support + +Technical support for the use of these products is provided by both EDB and Hashicorp. A proper support contract is required to be in place at both EDB and Hashicorp. A support ticket can be opened on either side to start the process. If it is determined through the support ticket that resources from the other vendor is required, the customer should open a support ticket with that vendor through normal support channels. This will allow both companies to work together to help the customer as needed. + +## Logging + +**EDB Postgres Advanced Server Logs:** + +Navigate to the `Data` directory in your chosen EDB Postgres Advanced Server instance and from here you can navigate to `log`, `current_logfiles` or you can navigate to the `postgresql.conf` file where you can customize logging options or enable `edb_audit` logs. + +** Hashicorp Vault Logs** + +Customers can use the `journalctl` function to call logs for Hashicorp Vault. + +If you just want to view the Vault logs you can do so by entering `journalctl -ex -u vault` in the command line. + +If you want to view logs for a specific day and output those results to a `.txt` file you can do so by entering `journalctl -u vault -S today > vaultlog.txt` in the command line, adjusting the date to your needed date and the text title. \ No newline at end of file From 45001266b52a441087ddc31517f5e97a2eb0a67b Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Thu, 15 Jun 2023 13:03:39 -0400 Subject: [PATCH 03/18] Added correct index.js link --- src/pages/index.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/pages/index.js b/src/pages/index.js index 1787214b854..330c2380086 100644 --- a/src/pages/index.js +++ b/src/pages/index.js @@ -380,6 +380,9 @@ const Page = () => ( HPE + + Hashicorp Vault Transit Secrets Engine + Imperva Data Security Fabric From 1fdea7a4db3f99543e8ec3183bcce453e80ddafe Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Thu, 15 Jun 2023 14:26:26 -0400 Subject: [PATCH 04/18] Name fix --- .../HashicorpVaultTransitSecretsEngine/index.mdx | 4 ++-- src/pages/index.js | 9 +++------ 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/index.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/index.mdx index d18e5885d50..083cc5d871d 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/index.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/index.mdx @@ -1,5 +1,5 @@ --- -title: 'Hashicorp Transit Secrets Engine Implementation Guide' +title: 'Hashicorp Vault Transit Secrets Engine Implementation Guide' indexCards: simple directoryDefaults: iconName: handshake @@ -9,6 +9,6 @@ directoryDefaults:

EDB GlobalConnect Technology Partner Implementation Guide

-

Hashicorp Transit Secrets Engine

+

Hashicorp Vault Transit Secrets Engine

This document is intended to augment each vendor’s product documentation in order to guide the reader in getting the products working together. It is not intended to show the optimal configuration for the certified integration.

\ No newline at end of file diff --git a/src/pages/index.js b/src/pages/index.js index 330c2380086..4777462051d 100644 --- a/src/pages/index.js +++ b/src/pages/index.js @@ -358,6 +358,9 @@ const Page = () => ( Hashicorp Vault + + Hashicorp Vault Transit Secrets Engine + Imperva Data Security Fabric @@ -380,12 +383,6 @@ const Page = () => ( HPE - - Hashicorp Vault Transit Secrets Engine - - - Imperva Data Security Fabric - Nutanix AHV From d7b57ec46a56b3d90e558c97f76351ab2d0c772b Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Mon, 19 Jun 2023 08:19:17 -0400 Subject: [PATCH 05/18] Added Postgres Distribution Wording --- .../04-ConfiguringTransitSecretsEngine.mdx | 10 ++++++---- .../05-UsingTransitSecretsEngine.mdx | 8 ++++---- .../HashicorpVaultTransitSecretsEngine/07-Support.mdx | 4 ++++ 3 files changed, 14 insertions(+), 8 deletions(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx index 937a348706e..1b8697f4745 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx @@ -3,16 +3,18 @@ title: 'Configuration' description: 'Walkthrough on configuring the integration' --- -Implementing Hashicorp Vault with EDB Postgres Advanced Server version 15.2 and above, requires the following components: +Implementing Hashicorp Vault with EDB Postgres Advanced Server version 15.2 and above or EDB Postgres Extended Server version 15 and above, requires the following components: +!!! Note + The EDB Postgres Advanced Server version 15.2 and above and EDB Postgres Extended Server version 15 and above, products will be referred to as Postgres Distribution. The specific Distribution type will be dependant upon customer need or preference. -- EDB Postgres Advanced Server version 15.2 or above +- An active Postgres Distribution - Hashicorp Vault v1.13.3 - [Pykmip](https://pypi.org/project/PyKMIP/#files) - Python ## Prerequisites -- A running EDB Postgres Advanced Server instance +- A running Postgres Distribution - Hashicorp Vault installed and deployed per your VM environment ## Enable Hashicorp Vault Transit Secrets Engine @@ -29,7 +31,7 @@ Implementing Hashicorp Vault with EDB Postgres Advanced Server version 15.2 and root@ip-172-31-50-151:/home/ubuntu# export VAULT_ADDR='http://127.0.0.1:8200' root@ip-172-31-50-151:/home/ubuntu# export VAULT_TOKEN="hvs.D9lfoRBZYtdJY2t3lG3f6yUa" ``` -4. Before you enable the Transit Secrets Engine you can check your Vault Server status with `vault status` +4. Before you enable the Transit Secrets Engine you can check your Vault Server status with `vault status`. ```bash root@ip-172-31-50-151:/home/ubuntu# vault status Key Value diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx index 240d3b40fbf..345f02533ce 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx @@ -3,10 +3,10 @@ title: 'Using' description: 'Walkthrough of example usage scenarios' --- -After you have configured Hashicorp Vault Transit Secrets Engine as stated in the Configuring section, you will be able to then encrypt your EDB Postgres Advanced Server database. +After you have configured Hashicorp Vault Transit Secrets Engine as stated in the Configuring section, you will be able to then encrypt your Postgres Distribution database. !!! Note - It is important to note that this doc is intended for versions 15.2 and above of EDB Postgres Advanced Server or versions 15 and above of EDB Postgres Extended Server as this version supports Transparent Data Encryption (TDE). + It is important to note that this doc is intended for versions 15.2 and above of EDB Postgres Advanced Server or versions 15 and above of EDB Postgres Extended Server as these versions support Transparent Data Encryption (TDE). After the Hashicorp Vault Transit secrets engine is configured and a user/machine has a Vault token with the proper permissions, this was configured during your install and setup of Transit Secrets Engine, it can use this secrets engine to encrypt a key. @@ -14,7 +14,7 @@ After the Hashicorp Vault Transit secrets engine is configured and a user/machin After you have enabled Hashicorp Vault Transit Secrets Engine and created a key, you will be able to export the PGDATAKEYWRAPCMD and PGDATAKEYUNWRAPCMD to wrap and unwrap your encryption key and initialize your database. -1. Login to your EDB Postgres Advanced Server system as the database superuser, for example `sudo su - enterprisedb`. +1. Login to your Postgres Distribution as the database superuser, for example `sudo su - enterprisedb`. 2. Navigate to the `/bin` directory where your executables live. In our example it is `/usr/lib/edb-as/15/bin`. @@ -213,5 +213,5 @@ key_version 1 ``` As an added note, Hashicorp Vault does not store any data, that is up to the database user. For any more information on Hashicorp Vault Transit Secrets Engine visit the [Hashicorp](https://developer.hashicorp.com/vault/docs/secrets/transit) documentation. -For more information on how TDE is incorporated with EDB Postgres Advanced Server visit the [EDB Transparent Data Encryption](https://www.enterprisedb.com/docs/tde/latest/) documentation. +For more information on how TDE is incorporated with EDB Postgres Advanced Server and EDB Postgres Extended Server visit the [EDB Transparent Data Encryption](https://www.enterprisedb.com/docs/tde/latest/) documentation. diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/07-Support.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/07-Support.mdx index 1c36ee14f88..423d58ebc43 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/07-Support.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/07-Support.mdx @@ -13,6 +13,10 @@ Technical support for the use of these products is provided by both EDB and Hash Navigate to the `Data` directory in your chosen EDB Postgres Advanced Server instance and from here you can navigate to `log`, `current_logfiles` or you can navigate to the `postgresql.conf` file where you can customize logging options or enable `edb_audit` logs. +**EDB Postgres Extended Server Logs** + +Navigate to the `Data` directory in your chosen EDB Postgres Extended Server instance and from here you can navigate to `log`, or you can navigate to the `postgresql.conf` file where you can customize logging options. An example of the full path to view EDB Postgres Extended logs: `/var/lib/edb-pge/15/data/log`. + ** Hashicorp Vault Logs** Customers can use the `journalctl` function to call logs for Hashicorp Vault. From 725d344791bd2eff1412ab8dfa7d3275b1aee773 Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Mon, 19 Jun 2023 16:15:20 -0400 Subject: [PATCH 06/18] Guide Edits --- .../02-PartnerInformation.mdx | 4 ++-- .../04-ConfiguringTransitSecretsEngine.mdx | 4 +--- .../Images/HashicorpVaultTransitSecretsEngineArchitecture.png | 3 +++ 3 files changed, 6 insertions(+), 5 deletions(-) create mode 100644 advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx index 3e9395aaa07..488591d9113 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx @@ -7,6 +7,6 @@ description: 'Details of the Partner' | ----------- | ----------- | | **Partner Name** | Hashicorp | | **Web Site** | https://www.hashicorp.com/ | -| **Partner Product** | Vault | +| **Partner Product** | Vault Transit Secrets Engine | | **Version** | Vault v1.13.3 | -| **Product Description** | Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server and EDB Postgres Extended Server, it allows users to control access to encryption keys and certificates, as well as perform key management. | \ No newline at end of file +| **Product Description** | Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server and EDB Postgres Extended Server, Hashicorp Vault Transit secrets engine allows Vault to handle cryptographic functions on data in-transit. | \ No newline at end of file diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx index 1b8697f4745..48673145351 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx @@ -9,8 +9,6 @@ Implementing Hashicorp Vault with EDB Postgres Advanced Server version 15.2 and - An active Postgres Distribution - Hashicorp Vault v1.13.3 -- [Pykmip](https://pypi.org/project/PyKMIP/#files) -- Python ## Prerequisites @@ -55,7 +53,7 @@ root@ip-172-31-50-151:/home/ubuntu# vault secrets enable transit Success! Enabled the transit secrets engine at: transit/ ``` -6. Next you will create your encryption key with an identifiable name. +6. Next you will create your encryption key with an identifiable name. For example: `vault write -f transit/keys/pg-tde-master-1` ```bash root@ip-172-31-50-151:/usr/lib/edb-pge/15/bin# vault write -f transit/keys/pg-tde-master-1 Success! Data written to: transit/keys/pg-tde-master-1 diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png new file mode 100644 index 00000000000..2339df92969 --- /dev/null +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:0793821162ad7af001a1c4102526c1ea0384954246a938ba042e889f3c0d07d3 +size 377715 From b12a9a1e14033a128ea52ce70a004c1d20c66c82 Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Tue, 20 Jun 2023 08:11:49 -0400 Subject: [PATCH 07/18] Solution Summary --- .../HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx index 633c405ff60..b587ce2eed5 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx @@ -7,5 +7,6 @@ Hashicorp Vault is an identity-based secrets and encryption management system. U Hashicorp Vault’s primary use case for Transit secrets engine is to encrypt data from applications while simultaneously storing encrypted data in some primary data store. Hashicorp Vault Transit Secrets Engine can also generate hashes, sign and verify data and generate HMAC' of data. -![Hashicorp Vault Transit Secrets Engine Architecture](Images/HashicorpVaultTransitSecretsEngineArchitecture.png) +The below image shows how Hashicorp Vault Transit Secrets Engine works to encrypt and decrypt data. + ![Hashicorp Vault Transit Secrets Engine Architecture](Images/HashicorpVaultTransitSecretsEngineArchitecture.png) From d229a04f80c304ad658e1fae13369cd1444c3e2c Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Wed, 21 Jun 2023 09:15:24 -0400 Subject: [PATCH 08/18] Solution Summary Update --- .../03-SolutionSummary.mdx | 8 +++++++- ...ashicorpVaultTransitSecretsEngineArchitecture(old).png | 3 +++ .../HashicorpVaultTransitSecretsEngineArchitecture.png | 4 ++-- 3 files changed, 12 insertions(+), 3 deletions(-) create mode 100644 advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture(old).png diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx index b587ce2eed5..c9c9a3a1ee3 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx @@ -5,8 +5,14 @@ description: 'Explanation of the solution and its purpose' Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server versions 15.2 and above or EDB Postgres Extended Server versions 15 and above, it allows users to control access to encryption keys and certificates, as well as perform key management. Using Hashicorp Vault’s Transit secrets engine allows Vault to handle cryptographic functions on data in-transit. Hashicorp Vault Transit secrets engine can be referred to as "encryption as a service". -Hashicorp Vault’s primary use case for Transit secrets engine is to encrypt data from applications while simultaneously storing encrypted data in some primary data store. Hashicorp Vault Transit Secrets Engine can also generate hashes, sign and verify data and generate HMAC' of data. +Hashicorp Vault’s primary use case for Transit secrets engine is to encrypt data from applications while simultaneously storing encrypted data in some primary data store. Hashicorp Vault Transit Secrets Engine can also generate hashes, sign and verify data and generate HMACs of data. Hashicorp Vault Transit Secrets Engine can work with EDB Postgres Advanced Server and EDB Postgres Extended Server by securely storing the the data key that is generated by `initdb`. Normally the key, that lives in `pg_encryption/key.bin`, is stored in plaintext format, but using Hashicorp Vault Transit Secrets Engine as an external key store manages the data encryption key and provides further security to the key itself. The below image shows how Hashicorp Vault Transit Secrets Engine works to encrypt and decrypt data. ![Hashicorp Vault Transit Secrets Engine Architecture](Images/HashicorpVaultTransitSecretsEngineArchitecture.png) +1. User connects to the app. +2. App sends some plaintext data to Vault to encrypt. +3. Hashicorp Vault encrypts the data for security. +4. When the app needs to use the data, Hashicorp Vault decrypts it. +5. The encrypted data is then sent back to the application in ciphertext format. +6. The application stores the ciphertext in a database or in Hashicorp Vault. diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture(old).png b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture(old).png new file mode 100644 index 00000000000..2339df92969 --- /dev/null +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture(old).png @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:0793821162ad7af001a1c4102526c1ea0384954246a938ba042e889f3c0d07d3 +size 377715 diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png index 2339df92969..dfab6b5a10f 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:0793821162ad7af001a1c4102526c1ea0384954246a938ba042e889f3c0d07d3 -size 377715 +oid sha256:56f28e55b9f1fff2415a94f25dbc4e8cd98e4af9e4889f4d99b84350c7134e99 +size 419446 From 9e0856ffda432d7914008ef1676c1bd374b0b27c Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Wed, 21 Jun 2023 09:40:09 -0400 Subject: [PATCH 09/18] Grammar error and font change --- .../03-SolutionSummary.mdx | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx index c9c9a3a1ee3..203acb9590a 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx @@ -5,14 +5,14 @@ description: 'Explanation of the solution and its purpose' Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server versions 15.2 and above or EDB Postgres Extended Server versions 15 and above, it allows users to control access to encryption keys and certificates, as well as perform key management. Using Hashicorp Vault’s Transit secrets engine allows Vault to handle cryptographic functions on data in-transit. Hashicorp Vault Transit secrets engine can be referred to as "encryption as a service". -Hashicorp Vault’s primary use case for Transit secrets engine is to encrypt data from applications while simultaneously storing encrypted data in some primary data store. Hashicorp Vault Transit Secrets Engine can also generate hashes, sign and verify data and generate HMACs of data. Hashicorp Vault Transit Secrets Engine can work with EDB Postgres Advanced Server and EDB Postgres Extended Server by securely storing the the data key that is generated by `initdb`. Normally the key, that lives in `pg_encryption/key.bin`, is stored in plaintext format, but using Hashicorp Vault Transit Secrets Engine as an external key store manages the data encryption key and provides further security to the key itself. +Hashicorp Vault’s primary use case for Transit secrets engine is to encrypt data from applications while simultaneously storing encrypted data in some primary data store. Hashicorp Vault Transit Secrets Engine can also generate hashes, sign and verify data and generate HMACs of data. Hashicorp Vault Transit Secrets Engine can work with EDB Postgres Advanced Server and EDB Postgres Extended Server by securely storing the data key that is generated by `initdb`. Normally the key, that lives in `pg_encryption/key.bin`, is stored in plaintext format, but using Hashicorp Vault Transit Secrets Engine as an external key store manages the data encryption key and provides further security to the key itself. The below image shows how Hashicorp Vault Transit Secrets Engine works to encrypt and decrypt data. ![Hashicorp Vault Transit Secrets Engine Architecture](Images/HashicorpVaultTransitSecretsEngineArchitecture.png) -1. User connects to the app. -2. App sends some plaintext data to Vault to encrypt. -3. Hashicorp Vault encrypts the data for security. -4. When the app needs to use the data, Hashicorp Vault decrypts it. -5. The encrypted data is then sent back to the application in ciphertext format. -6. The application stores the ciphertext in a database or in Hashicorp Vault. +**1.** User connects to the app. +**2.** App sends some plaintext data to Vault to encrypt. +**3.** Hashicorp Vault encrypts the data for security. +**4.** When the app needs to use the data, Hashicorp Vault decrypts it. +**5.** The encrypted data is then sent back to the application in ciphertext format. +**6.** The application stores the ciphertext in a database or in Hashicorp Vault. From 3dd77bd0c5cdc2c5e23e4cb7b66e378f89306bf5 Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Wed, 21 Jun 2023 10:04:23 -0400 Subject: [PATCH 10/18] Adding Spacing --- .../03-SolutionSummary.mdx | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx index 203acb9590a..3b180cf4dc1 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx @@ -11,8 +11,13 @@ The below image shows how Hashicorp Vault Transit Secrets Engine works to encryp ![Hashicorp Vault Transit Secrets Engine Architecture](Images/HashicorpVaultTransitSecretsEngineArchitecture.png) **1.** User connects to the app. + **2.** App sends some plaintext data to Vault to encrypt. + **3.** Hashicorp Vault encrypts the data for security. + **4.** When the app needs to use the data, Hashicorp Vault decrypts it. + **5.** The encrypted data is then sent back to the application in ciphertext format. + **6.** The application stores the ciphertext in a database or in Hashicorp Vault. From 484ae88cc44a6ff85f3ae3a2d82bebb7804d4346 Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Fri, 23 Jun 2023 13:53:57 -0400 Subject: [PATCH 11/18] Wording Edits --- .../03-SolutionSummary.mdx | 14 +------------- .../04-ConfiguringTransitSecretsEngine.mdx | 8 ++++---- .../05-UsingTransitSecretsEngine.mdx | 6 +++--- .../06-CertificationEnvironment.mdx | 2 +- ...hicorpVaultTransitSecretsEngineArchitecture.png | 4 ++-- 5 files changed, 11 insertions(+), 23 deletions(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx index 3b180cf4dc1..375f5732b2a 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/03-SolutionSummary.mdx @@ -3,21 +3,9 @@ title: 'Solution Summary' description: 'Explanation of the solution and its purpose' --- -Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server versions 15.2 and above or EDB Postgres Extended Server versions 15 and above, it allows users to control access to encryption keys and certificates, as well as perform key management. Using Hashicorp Vault’s Transit secrets engine allows Vault to handle cryptographic functions on data in-transit. Hashicorp Vault Transit secrets engine can be referred to as "encryption as a service". +Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server versions 15.2 and above or EDB Postgres Extended Server versions 15.2 and above, it allows users to control access to encryption keys and certificates, as well as perform key management. Using Hashicorp Vault’s Transit secrets engine allows Vault to handle cryptographic functions on data in-transit. Hashicorp Vault Transit secrets engine can be referred to as "encryption as a service". Hashicorp Vault’s primary use case for Transit secrets engine is to encrypt data from applications while simultaneously storing encrypted data in some primary data store. Hashicorp Vault Transit Secrets Engine can also generate hashes, sign and verify data and generate HMACs of data. Hashicorp Vault Transit Secrets Engine can work with EDB Postgres Advanced Server and EDB Postgres Extended Server by securely storing the data key that is generated by `initdb`. Normally the key, that lives in `pg_encryption/key.bin`, is stored in plaintext format, but using Hashicorp Vault Transit Secrets Engine as an external key store manages the data encryption key and provides further security to the key itself. The below image shows how Hashicorp Vault Transit Secrets Engine works to encrypt and decrypt data. ![Hashicorp Vault Transit Secrets Engine Architecture](Images/HashicorpVaultTransitSecretsEngineArchitecture.png) - -**1.** User connects to the app. - -**2.** App sends some plaintext data to Vault to encrypt. - -**3.** Hashicorp Vault encrypts the data for security. - -**4.** When the app needs to use the data, Hashicorp Vault decrypts it. - -**5.** The encrypted data is then sent back to the application in ciphertext format. - -**6.** The application stores the ciphertext in a database or in Hashicorp Vault. diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx index 48673145351..fcd2c9e2b0c 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx @@ -3,16 +3,16 @@ title: 'Configuration' description: 'Walkthrough on configuring the integration' --- -Implementing Hashicorp Vault with EDB Postgres Advanced Server version 15.2 and above or EDB Postgres Extended Server version 15 and above, requires the following components: +Implementing Hashicorp Vault with EDB Postgres Advanced Server version 15.2 and above or EDB Postgres Extended Server version 15.2 and above, requires the following components: !!! Note - The EDB Postgres Advanced Server version 15.2 and above and EDB Postgres Extended Server version 15 and above, products will be referred to as Postgres Distribution. The specific Distribution type will be dependant upon customer need or preference. + The EDB Postgres Advanced Server version 15.2 and above and EDB Postgres Extended Server version 15.2 and above, products will be referred to as EDB Postgres distribution. The specific distribution type will be dependant upon customer need or preference. -- An active Postgres Distribution +- EDB Postgres distribution (15.2 or later) - Hashicorp Vault v1.13.3 ## Prerequisites -- A running Postgres Distribution +- A running EDB Postgres distribution - Hashicorp Vault installed and deployed per your VM environment ## Enable Hashicorp Vault Transit Secrets Engine diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx index 345f02533ce..997ef875d20 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/05-UsingTransitSecretsEngine.mdx @@ -3,10 +3,10 @@ title: 'Using' description: 'Walkthrough of example usage scenarios' --- -After you have configured Hashicorp Vault Transit Secrets Engine as stated in the Configuring section, you will be able to then encrypt your Postgres Distribution database. +After you have configured Hashicorp Vault Transit Secrets Engine as stated in the Configuring section, you will be able to then encrypt your EDB Postgres distribution database. !!! Note - It is important to note that this doc is intended for versions 15.2 and above of EDB Postgres Advanced Server or versions 15 and above of EDB Postgres Extended Server as these versions support Transparent Data Encryption (TDE). + It is important to note that this doc is intended for versions 15.2 and above of EDB Postgres Advanced Server or versions 15.2 and above of EDB Postgres Extended Server as these versions support Transparent Data Encryption (TDE). After the Hashicorp Vault Transit secrets engine is configured and a user/machine has a Vault token with the proper permissions, this was configured during your install and setup of Transit Secrets Engine, it can use this secrets engine to encrypt a key. @@ -14,7 +14,7 @@ After the Hashicorp Vault Transit secrets engine is configured and a user/machin After you have enabled Hashicorp Vault Transit Secrets Engine and created a key, you will be able to export the PGDATAKEYWRAPCMD and PGDATAKEYUNWRAPCMD to wrap and unwrap your encryption key and initialize your database. -1. Login to your Postgres Distribution as the database superuser, for example `sudo su - enterprisedb`. +1. Login to your EDB Postgres distribution as the database superuser, for example `sudo su - enterprisedb`. 2. Navigate to the `/bin` directory where your executables live. In our example it is `/usr/lib/edb-as/15/bin`. diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/06-CertificationEnvironment.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/06-CertificationEnvironment.mdx index e03cc996f9b..11263baf41a 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/06-CertificationEnvironment.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/06-CertificationEnvironment.mdx @@ -7,5 +7,5 @@ description: 'Overview of the certification environment' | ----------- | ----------- | | **Certification Test Date** | June 12, 2023 | | **EDB Postgres Advanced Server** | 15.2 | -| **EDB Postgres Extended Server** | 15 | +| **EDB Postgres Extended Server** | 15.2 | | **Hashicorp Vault** | v1.13.3 | \ No newline at end of file diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png index dfab6b5a10f..b3c8717b382 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:56f28e55b9f1fff2415a94f25dbc4e8cd98e4af9e4889f4d99b84350c7134e99 -size 419446 +oid sha256:9b75741ca83107edee593855d5224765f35a49ba6333ee4393948e586afbb4ac +size 241968 From ec5d7257cf6c9007d443ae6dff71c8b8d6dac239 Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Wed, 5 Jul 2023 10:01:29 -0400 Subject: [PATCH 12/18] Spelling Change --- .../04-ConfiguringTransitSecretsEngine.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx index fcd2c9e2b0c..71822226255 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/04-ConfiguringTransitSecretsEngine.mdx @@ -5,7 +5,7 @@ description: 'Walkthrough on configuring the integration' Implementing Hashicorp Vault with EDB Postgres Advanced Server version 15.2 and above or EDB Postgres Extended Server version 15.2 and above, requires the following components: !!! Note - The EDB Postgres Advanced Server version 15.2 and above and EDB Postgres Extended Server version 15.2 and above, products will be referred to as EDB Postgres distribution. The specific distribution type will be dependant upon customer need or preference. + The EDB Postgres Advanced Server version 15.2 and above and EDB Postgres Extended Server version 15.2 and above, products will be referred to as EDB Postgres distribution. The specific distribution type will be dependent upon customer need or preference. - EDB Postgres distribution (15.2 or later) - Hashicorp Vault v1.13.3 From 1e2162014cc574caacf787555e976fc3d61747ae Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Mon, 12 Jun 2023 13:45:15 -0400 Subject: [PATCH 13/18] Tech Partner Hashicorp Transit Secrets Engine Guide --- .../02-PartnerInformation.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx index 488591d9113..e1b724bf185 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx @@ -9,4 +9,4 @@ description: 'Details of the Partner' | **Web Site** | https://www.hashicorp.com/ | | **Partner Product** | Vault Transit Secrets Engine | | **Version** | Vault v1.13.3 | -| **Product Description** | Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server and EDB Postgres Extended Server, Hashicorp Vault Transit secrets engine allows Vault to handle cryptographic functions on data in-transit. | \ No newline at end of file +| **Product Description** | Hashicorp Vault is an identity-based secrets and encryption management system. Used in conjunction with EDB Postgres Advanced Server and EDB Postgres Extended Server, Hashicorp Vault Transit secrets engine allows Vault to handle cryptographic functions on data in-transit. | From 7b0654762a2a3fd371d4cbefb4d7d2b7c929f432 Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Mon, 19 Jun 2023 16:15:20 -0400 Subject: [PATCH 14/18] Guide Edits --- .../Images/HashicorpVaultTransitSecretsEngineArchitecture.png | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png index b3c8717b382..cdbe7d41bfd 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:9b75741ca83107edee593855d5224765f35a49ba6333ee4393948e586afbb4ac -size 241968 +oid sha256:d084b0b001f3b61a0609cff8e3aa8076e8aae7206228bbc8dbeda6a87c63d218 +size 272 From 8af57ba3ea55c598466005ed22d0a1f6450f232f Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Wed, 21 Jun 2023 09:15:24 -0400 Subject: [PATCH 15/18] Solution Summary Update --- .../Images/HashicorpVaultTransitSecretsEngineArchitecture.png | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png index cdbe7d41bfd..675c6ab5ad2 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:d084b0b001f3b61a0609cff8e3aa8076e8aae7206228bbc8dbeda6a87c63d218 -size 272 +oid sha256:5bb1632ca9630055645bd3c02721c73e06202cd6ae4ff4a4f015d93d5a98ea02 +size 281 From 216cbb5cf3fc465f29c19e8f1e3270f581e0b6fc Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Fri, 23 Jun 2023 13:53:57 -0400 Subject: [PATCH 16/18] Wording Edits --- .../Images/HashicorpVaultTransitSecretsEngineArchitecture.png | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png index 675c6ab5ad2..cfdaaf23342 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/Images/HashicorpVaultTransitSecretsEngineArchitecture.png @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:5bb1632ca9630055645bd3c02721c73e06202cd6ae4ff4a4f015d93d5a98ea02 -size 281 +oid sha256:458fb7f4023abe16b7e4623982843cb390b8ff02523ca1a8d6358197b6c46283 +size 271 From f5bf60543c929ead8e49a9e2a6047c41df5fd630 Mon Sep 17 00:00:00 2001 From: jkitchens32 Date: Fri, 7 Jul 2023 15:19:30 -0400 Subject: [PATCH 17/18] Index.js update --- src/pages/index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pages/index.js b/src/pages/index.js index 4777462051d..8e93026a7ac 100644 --- a/src/pages/index.js +++ b/src/pages/index.js @@ -358,7 +358,7 @@ const Page = () => ( Hashicorp Vault - + Hashicorp Vault Transit Secrets Engine From fc4223f1d71dc7ed99291ce34b9be33747166543 Mon Sep 17 00:00:00 2001 From: jkitchens32 <106532490+jkitchens32@users.noreply.github.com> Date: Mon, 10 Jul 2023 10:38:01 -0400 Subject: [PATCH 18/18] Update advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx Co-authored-by: Dee Dee Rothery <83650384+drothery-edb@users.noreply.github.com> --- .../02-PartnerInformation.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx index e1b724bf185..016eedac129 100644 --- a/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx +++ b/advocacy_docs/partner_docs/HashicorpVaultTransitSecretsEngine/02-PartnerInformation.mdx @@ -1,6 +1,6 @@ --- title: 'Partner Information' -description: 'Details of the Partner' +description: 'Details of the partner' --- |   |   |