How to Replace Static Cloud Credentials with Vault Workload Identity Federation

Summary

• Static cloud credentials (IAM access keys, service principal secrets, GCP service account keys) are persistent liabilities — if stolen, they’re valid until manually rotated
• Vault Enterprise 2.0 replaces these with workload identity federation: short-lived tokens exchanged at runtime, never stored as long-lived secrets
• Supported across all three major clouds: AWS IAM web identity, Azure federated credentials, GCP workload identity pools
• Eliminates manual rotation cycles and reduces credential compromise blast radius — compromised short-lived tokens expire before they can be reused

Purpose

Most platform teams using HashiCorp Vault for secret management still rely on static cloud credentials at the destination layer: Vault holds the IAM access key that lets it write to AWS Secrets Manager, or the service principal that gives it access to Azure Key Vault. Those long-lived credentials are exactly the kind of persistent attack surface that credential theft targets. Vault Enterprise 2.0’s workload identity federation integration removes them from the equation by replacing stored static credentials with runtime token exchanges that expire after use.

This is the same architectural pattern that the Stack Archive covered for Terraform OIDC in multi-account AWS setups — applied now to Vault’s secret sync destinations.

Pre-requisites

• HashiCorp Vault Enterprise 2.0 (workload identity federation is an Enterprise feature)
• An existing Vault cluster with secret sync configured
• Cloud provider IAM configured to trust Vault’s identity token:
  • AWS: IAM role with web identity trust policy pointing to Vault’s JWKS endpoint
  • Azure: App registration with federated credential configured for Vault’s issuer
  • GCP: Workload identity pool with Vault as the OIDC provider

Steps

1. Configure Vault as an OIDC Provider

Vault Enterprise 2.0 exposes a JWKS endpoint for its workload identity tokens. Configure this endpoint in each cloud provider’s identity federation settings:

• AWS: Create an IAM OIDC identity provider with Vault’s issuer URL. Attach a role with the web identity trust policy: "Action": "sts:AssumeRoleWithWebIdentity" scoped to the Vault namespace or entity you’re federating.
• Azure: In the app registration, add a federated credential under “Certificates & secrets” with the subject claim matching Vault’s entity ID and the issuer set to Vault’s OIDC issuer URL.
• GCP: Create a workload identity pool and provider in IAM, mapping Vault token attributes to Google credentials.

2. Update Secret Sync Destination Configuration

In Vault, update the secret sync destination to use workload identity federation rather than a static credential. Remove any stored access keys or service principal secrets from the destination configuration. Vault will now obtain short-lived tokens at sync time by exchanging its workload identity token with the configured cloud provider.

3. Validate Token Exchange

Test the integration by triggering a manual sync and verifying in your cloud provider’s access logs that the request used a web identity role assumption (AWS) or federated identity (Azure/GCP) rather than a static credential. The access log entry will reference the assumed role ARN or federated service account rather than an access key ID.

4. Remove Static Credentials

Once the workload identity path is validated, revoke the long-lived credentials that were previously stored in Vault’s destination configuration. Rotate and invalidate:

• AWS IAM access keys
• Azure service principal client secrets
• GCP service account key files

Remove them from the Vault secret sync destination config entirely. If any rotation grace period is required by your security policy, schedule revocation after confirming sync operations are running cleanly on the federated path.

5. Set Up Monitoring

Configure alerts for token exchange failures — if the workload identity federation trust relationship breaks (e.g., Vault’s JWKS endpoint is unreachable, or the IAM trust policy is modified), secret sync will fail silently. Monitor for:

• Failed sync attempts in Vault audit logs
• Identity token validation errors in cloud provider IAM logs

The Trap

Certificate rotation breaks the JWKS trust chain. If Vault’s signing certificate is rotated as part of a certificate lifecycle operation, the JWKS endpoint will serve a new public key. Cloud providers that have cached the previous key material — or that have pinned a specific key ID — will reject Vault’s identity tokens until the trust relationship is updated. Before rotating Vault’s signing certificate, confirm that each cloud provider’s OIDC configuration can handle key rollover gracefully. AWS OIDC identity providers handle this automatically; Azure and GCP may require manual thumbprint or JWKS URL refresh.

Cited References

• HashiCorp Vault Enterprise: Workload Identity Federation for Secret Sync
• AWS IAM Roles: Web Identity Federation
• GCP Workload Identity Federation Documentation

Photo by Jakub Zerdzicki on Pexels

Source: HashiCorp Blog

Content created with AI assistance and reviewed for accuracy.