index aws-parameter-store
Beta feature
This feature is currently available as beta. The beta functionality is stable but possibly incomplete and subject to change. We strongly discourage using beta features in production.
Note
You must have version 0.5.0 or higher of the Vault Radar CLI installed.
To check the current version of your CLI, use the version command.
The index aws-parameter-store
command is used for creating an index of secure strings in AWS Parameter Store.
Note
Only parameters of type SecureString
are indexed as they are secure by definition.
Authentication
The index aws-parameter-store
command needs permissions to read the parameter,
its history and tags, see the following simplified policy document.
See AWS Authentication for more information on how to authenticate with AWS.
Usage
Command options
--region, -r
: Specifies the region of AWS Parameter Store to scan (required)--outfile , -o
: Specifies the file to store information about found secrets (required)--offline
: Specifies that the scan should be run in offline mode, without connecting to HCP--disable-ui
: Specifies that the scan summary should not be logged to stdout
HCP connection indexing behavior
The default behavior of index commands is to require an HCP cloud connection to scan. This is to ensure that hashes are generated using a shared salt from the cloud keeping consistency across indexes. In order to populate the HCP connection information needed, refer to the HCP upload page.
To allow for scanning to continue working without the need for HCP cloud
connection you can use the new --offline
flag as such.
Generate an index file
Index files are generated in an "online mode" by default, meaning that the
secret hash produced is using a salt that is provided from HCP. This requires
the Project Service Principals to be configured for your system as outlined by
the HCP upload
page. If you do not want to use the index file for HCP upload and visualization
you can use the --offline
flag to use a local hashing salt and not error if
the Service Principals are not configured.
Generate index file using HCP provided salt
To generate an index file using the SecureString
parameters
Consuming an index file
To consume the resulting index file use the index-file
flag when calling a
scan command. E.g.