open-vault/website/pages/docs/secrets/databases/redshift.mdx

88 lines
3.1 KiB
Plaintext

---
layout: docs
page_title: Redshift - Database - Secrets Engines
sidebar_title: Redshift
description: |-
Redshift is a supported plugin for the database secrets engine.
This plugin generates database credentials dynamically based on configured
roles for the AWS Redshift database service.
---
# Redshift Database Secrets Engine
Redshift is a supported plugin for the database secrets engine. This
plugin generates database credentials dynamically based on configured roles for
the AWS Redshift database service, and also supports [Static
Roles](/docs/secrets/databases#static-roles).
See the [database secrets engine](/docs/secrets/databases) docs for
more information about setting up the database secrets engine.
## Capabilities
| Plugin Name | Root Credential Rotation | Dynamic Roles | Static Roles |
| -------------------------- | ------------------------ | ------------- | ------------ |
| `redshift-database-plugin` | Yes | Yes | Yes |
## Setup
1. Enable the database secrets engine if it is not already enabled:
```text
$ vault secrets enable database
Success! Enabled the database secrets engine at: database/
```
By default, the secrets engine will enable at the name of the engine. To
enable the secrets engine at a different path, use the `-path` argument.
1. Configure Vault with the proper plugin and connection information to access your Redshift database:
```text
$ vault write database/config/my-redshift-database \
plugin_name=redshift-database-plugin \
allowed_roles="my-role" \
connection_url="postgresql://{{username}}:{{password}}@localhost:5432/<optional: db-name>" \
username="vaultuser" \
password="vaultpass"
```
1. Configure a role that maps a name in Vault to a SQL statement to execute which
creates the database credential:
```text
$ vault write database/roles/my-role \
db_name=my-redshift-database \
creation_statements="CREATE USER \"{{name}}\" WITH PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
default_ttl="1h" \
max_ttl="24h"
Success! Data written to: database/roles/my-role
```
## Usage
After the secrets engine is configured and a user/machine has a Vault token with
the proper permission, it can generate credentials.
1. Generate a new credential by reading from the `/creds` endpoint with the name
of the role:
```text
$ vault read database/creds/my-role
Key Value
--- -----
lease_id database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
lease_duration 1h
lease_renewable true
password FFdcFM1vSFc-9sVhyTPY
username v-vaultuse-my-role-zi0460sr1hwm98qugxu8-1602542706
```
## API
The full list of configurable options can be seen in the [Redshift database
plugin API](/api/secret/databases/redshift) page.
For more information on the database secrets engine's HTTP API please see the
[Database secrets engine API](/api/secret/databases) page.