search

BetterCloud / vault-java-driver

Zero-dependency Java client for HashiCorp's Vault
https://bettercloud.github.io/vault-java-driver/
335 stars 224 forks source link

Can't generate AWS credentials using roles #193

Open craigday opened 4 years ago

craigday commented 4 years ago

You should be able to generate dynamic AWS credentials by role by writing to /aws/creds/RoleName e.g.

LogicalResponse credentialsResponse = vault.logical()
.write("aws/creds/SomeRole", Collections.singletonMap("ttl", "180s"));

Unfortunately vault-java-driver internally changes this path to /aws/data/creds/SomeRole

craigday commented 4 years ago

OK, I have worked out how to make this work by dynamically switching between versions using the engine mapping, but it's ugly because the role names are dynamic and the engine mapping happens at driver configuration time. See pull request https://github.com/BetterCloud/vault-java-driver/pull/194 for a change that improves the situation slightly.

In the next major version, you should drop multi-version support. It's a bit of a mess.