CODEWITHSUNDEEP
c#hashicorp-vaultvaultvaultsharp
illug
illug

Reputation: 823

Using static database roles with VaultSharp

I am looking into using VaultSharp to manage static roles for my Microsoft SQL Server and having a hard time getting it to work the way I expected and believe that the implementation by VaultSharp might be off in this area.

This is my code that creates the static role needed:

    public async Task CreateStaticRole(string roleName)
    {
        var vaultClient = InitializeVaultClient();
        var role = new StaticRole
        {
            DatabaseProviderType = DatabaseProviderType.MySQL,
            Username = roleName,
            RotationPeriod = "30",
            RotationStatements = new List<string>() { "ALTER LOGIN \"{{name}}\" WITH PASSWORD = '{{password}}';" }
        };

        await vaultClient.V1.Secrets.Database.CreateStaticRoleAsync(roleName, role);
    }

Note that I am using MySQL as the database provider type. The reason for that is that MSSQL is not available as a database provider but even if it was that implementation doesn't allow you to manage multiple SQL servers with one instance of HashiCorp Vault. The database provider type corresponds with the config name supplied to Vault like in the command below so my code here with that Vault config actually works but a bit hacky and also does not allow me to manage static roles on multiple SQL servers (although I could manage one per available database provider type which there are 5 in total).

`vault write database/config/mysql plugin_name=mssql-database-plugin connection_url='sqlserver://{{username}}:{{password}}@sqlserver:1433' allowed_roles="*" username="sa" password="Password"`

Maybe I am missing something here and if someone can offer advice that would be greatly appreciated.

EDIT I can probably get around this by using different mounts instead of the default one, so database/config/sqlserver1/mysql etc. but still a bit hacky.

Upvotes: 1

Views: 311

Answers (0)

Related Questions