Hashicorp Webinar - Vault Cloud Security - Spanish
•Descargar como PPTX, PDF•
1 recomendación•299 vistas
Overview of how Vault can support companies going to the cloud, from a security perspective
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (7)
Similar a Hashicorp Webinar - Vault Cloud Security - Spanish
Similar a Hashicorp Webinar - Vault Cloud Security - Spanish (20)
Más de Stenio Ferreira
Más de Stenio Ferreira (17)
Último
Último (10)
Hashicorp Webinar - Vault Cloud Security - Spanish
- 1. Copyright © 2019 HashiCorp Seguridad en la nube con Vault
- 2. © 2019 HashiCorp 2 Background • Senior Solutions Engineer • En Hashicorp hace un año y medio • Desarrollo / Consultor / Vantasventas • Brasileño • Tocado en una banda de heavy metal. @stenio123 stenio@hashicorp.com Copyright © 2019 HashiCorp ∕ 2
- 3. © 2019 HashiCorp 3 Agenda • Transformación digital • Desafíos de seguridad para ir a la nube • Demostración 1: Autenticación segura en la nube • Demostración 2: acceso seguro a los servicios en la nube • Preguntas y respuestas Copyright © 2019 HashiCorp ∕ 2
- 4. Copyright © 2018 HashiCorp ∕ Transformación Digital 4
- 5. Copyright © 2019 HashiCorp ∕ Transformación Digital Copyright © 2019 HashiCorp ∕ 5 Traditional Datacenter “Static” Dedicated Infrastructure Modern Datacenter “Dynamic” AWS Azure GCP+ + +Private Cloud + “Ticket-based” “Self-service”
- 6. Copyright © 2019 HashiCorp ∕Copyright © 2019 HashiCorp ∕ 6 Traditional Datacenter “Static” Dedicated Infrastructure Modern Datacenter “Dynamic” AWS Azure GCP+ + +Private Cloud + Why? • Capex to Opex • Scale, repeatability, maintainability • Access to new technologies Transformación Digital
- 7. Copyright © 2019 HashiCorp ∕ Desafíos de Alto Nivel Durante la Transformación Digital Copyright © 2019 HashiCorp ∕ 7
- 8. Copyright © 2018 HashiCorp ∕ 8 Un Enfoque Integrado con Hashicorp Suite C++ Provision Operations Secure Security Run Development Connect Networking Private Cloud AWS Azure GCP
- 9. Copyright © 2018 HashiCorp ∕ Seguridad Durante la Transformación Digital 9
- 10. Copyright © 2019 HashiCorp ∕Copyright © 2019 HashiCorp ∕ 10 Desafíos de Seguridad Durante la Transformación Digital • Manejo de secretos Contraseñas, claves API, certificados PKI, claves de cifrado • Autenticación Identidad de la solicitud: "Soy quien digo ser, esta es mi credencial" • Autorización Permisos asociados con una identidad: "El usuario X puede leer el secreto Y" • Cifrado en reposo La información confidencial se almacena en texto cifrado • Cifrado en tránsito Información sensible intercambiada entre puntos finales en texto cifrado • Scaling en multiplos centros de datos, DR, auditoría, flujos de trabajo de aprobación, compliance y otros
- 11. Copyright © 2019 HashiCorp ∕Copyright © 2019 HashiCorp ∕ 11 Desafíos de Autenticación en la Nube Por lo tanto, ¿Cómo permito que una aplicación que se ejecuta en la nube tenga acceso a un secreto sin hardcoding este secreto? ¿Cómo permito que un cliente (humano / aplicación) se ejecute en cualquier lugar, acceda a servicios en la nube, sin hardcoding las claves de acceso? Enfoque estándar: Claves API estáticas / service accounts Limitaciones: • Eventualmente hardcoded: mayor riesgo de verse comprometido • Dificil de administrar ciclo de vida: mayor riesgo de exposición • Difícil de auditar: el usuario original puede compartirlo con otros
- 12. Copyright © 2019 HashiCorp ∕Copyright © 2019 HashiCorp ∕ 12 ¿Cómo permito que una aplicación que se ejecuta en la nube tenga acceso a un secreto sin hacer hardcoding codificar este secreto? -> Autenticación Vault basada en plataforma ¿Cómo permito que un cliente (humano / aplicación) se ejecute en cualquier lugar, acceda a servicios en la nube, sin hacer hardcoding de claves? -> Secretos dinámicos Vault Desafíos de Autenticación en la Nube
- 13. Copyright © 2019 HashiCorp ∕Copyright © 2019 HashiCorp ∕ 13 Autenticación de Vault Basada en Plataforma Overview • En lugar de codificar credenciales en una aplicación, use la identidad dada por la plataforma • Ejemplo: AWS usa el perfil IAM asociado con EC2 o Lambda Azure usa la cuenta de servicio, GCP usa XX • Estas plataformas permiten llamadas al API local endpoint para recuperar el token de identidad • La lógica se puede codificar manualmente en la aplicación o se puede externalizar utilizando agentes: Vault Agent, Consul Template, Cron job • Suporta: Cloud, Kubernetes, PCF, AppRole Passos 1. El administrador crea credenciales y configura Vault 2. La aplicación recupera la identidad de plataforma 3. La aplicación realiza login en Vault y envía identidad 4. Vault valida la identidad con la plataforma y devuelve el token de acceso a la aplicación
- 14. Copyright © 2019 HashiCorp ∕Copyright © 2019 HashiCorp ∕ 14 Secredos Dinámicos com Vault Overview • En lugar de tener una API key de larga duración, puede generar dinámicamente, según sea necesario • Estas claves serán efímeras, con un TTL asociado • Vault responsable de revocar la clave cuando TTL llegó • Un administrador de Vault también puede revocar claves o grupos de claves (por prefijo) sin necesidad de acceder a las plataformas. • Opciones específicas de la plataforma: los secretos generados pueden ser únicos. Las cuentas de servicio pueden reutilizarse. Se admite la rotación de contraseñas (Active Directory) • Secretos dinámicos para: nube, bases de datos, plugins Passos 1. El administrador crea credenciales y configura Vault 2. El cliente autenticado en Vault realiza una solicitud de segreto 3. Vault crea secreto y devuelve al cliente 4. Cuando se agota el tiempo de espera, Vault revoca secreto
- 15. Copyright © 2018 HashiCorp ∕ Demos 15
- 16. Copyright © 2019 HashiCorp ∕Copyright © 2019 HashiCorp ∕ 16 Demo 1 - Autenticación Contexto • Una aplicación que se ejecuta en AWS • Necesita acceder a una base de datos, por lo tanto, necesita credenciales db • En lugar de codificar estas credenciales, las almacenaremos en Vault • Pero, ¿cómo puede la aplicación autenticarse con Vault? Codificar las credenciales de Vault anula el propósito • Podemos usar la autenticación AWS de Vault para abstraer las credenciales • Una vez que la aplicación se autentica con Vault, puede solicitar las credenciales de db deseadas TL;DR: La aplicación necesita un secreto. Lo obtiene de Vault sin credenciales explícitas.
- 17. Copyright © 2019 HashiCorp ∕Copyright © 2019 HashiCorp ∕ 17 Demo 2 - Secredos Dinámicos Contexto • Un desarrollador necesita acceso a un bucket S3 de AWS • Para acceder a este recurso de AWS, necesito claves de API de AWS • En lugar de tener claves API estáticas de larga duración, Vault generará dinámicamente estas claves cuando sean necesarias. • Como humano, puedo autenticarme con Vault con credenciales tradicionales, o como aplicación puedo usar un flujo de trabajo como se presenta en la Demo 1 • Una vez que me autentico con Vault, puedo solicitar las claves API • Un administrador de almacén puede establecer el tiempo de vida de estas claves, permisos y qué identidades tienen acceso para solicitarlas. • Cada clave generada será única TL;DR: El cliente necesita claves de nube. Vault genera claves y las revoca siguiendo TTL
- 18. Copyright © 2018 HashiCorp ∕ Próximos Pasos 18
- 19. Copyright © 2019 HashiCorp ∕Copyright © 2019 HashiCorp ∕ 19 Mejorando las Demos • Resiliencia Usar Vault como un clúster de alta disponibilidad No codifique los secretos de Vault en Terrafom (use Replicación y DR) Usar infraestructura inmutable (imágenes de servidor) • Conectividad Use TLS para conexiones de Vault Use Vault en subred privada No permita ssh directo en instancias, use bastión hosts Use Service Mesh para asegurar la comunicación entre el servidor y el bastión host (Consul) • Permisos Use usuarios de Linux con permisos restringidos Use usuarios de bóveda con permisos restringidos Use usuarios de la nube con permisos restringidos • Gestión Use Vault Agent para administrar la lógica de autenticación en la nube Coloque Vault como parte de un clúster de Service Discovery(Consul)
- 20. Copyright © 2019 HashiCorp ∕Copyright © 2019 HashiCorp ∕ 20 Recursos Vault Agent Tutorial: https://learn.hashicorp.com/vault/developer/vault-agent-aws Discusión sobre Immutable Infrastructure: https://www.hashicorp.com/resources/what-is-mutable-vs-immutable-infrastructure Discusión sobre Secredos Dinámicos https://www.hashicorp.com/blog/why-we-need-dynamic-secrets Cómo Adobe está utilizando Vault para administrar secretos a través de clouds: https://youtu.be/THlpkBioAWQ Demos https://github.com/stenio123/vault_cloud_security
- 21. ∕Copyright © 2019 HashiCorp 21 www.hashicorp.com hello@hashicorp.com Thank you
Notas del editor
- <note to presenter> frame the discussion to indicate that there are really three pictures that matter #1 is the transition in infrastructure #2 is how we think about them in layers #3 is what success looks like in terms of core Terraform, Vault and Consul as a shared service
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- <note to presenter> frame the discussion to indicate that there are really three pictures that matter #1 is the transition in infrastructure #2 is how we think about them in layers #3 is what success looks like in terms of core Terraform, Vault and Consul as a shared service
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- <note to presenter> frame the discussion to indicate that there are really three pictures that matter #1 is the transition in infrastructure #2 is how we think about them in layers #3 is what success looks like in terms of core Terraform, Vault and Consul as a shared service
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- <note to presenter> frame the discussion to indicate that there are really three pictures that matter #1 is the transition in infrastructure #2 is how we think about them in layers #3 is what success looks like in terms of core Terraform, Vault and Consul as a shared service
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.
- Talk about what’s happening in the world of infrastructure where we are going through a transition that happens in our industry every 20 years: this time from one which is largely dedicated servers in a private datacenter to a pool of compute capacity available on demand. In simple terms, this is a shift from “static” infrastructure to ‘dynamic infrastructure’ which is the reality of cloud. And while the first cloud provider was AWS, it is clear that it will be a multi-cloud world. Each of these platforms have their own key advantages and so it is inevitable that most G2K organizations will use more than one. This is not about moving applications around (since data gravity is a constraint) but rather creates a need for a common operating model across these distinct platforms that allows different teams to leverage the platform for their choice.