vault-ruby: Can't Parse Secret Response from Vault

I’m using the vault gem (v 0.1.5) with my Chef cookbook to interact with my Vault server. My instance is able to authenticate against the Vault server, but is not able to parse the response data.

Here’s my Chef recipe code:

chef_gem 'json'
chef_gem 'vault'
require 'json'
require 'vault'

Vault.address = '127.0.0.1'
Vault.auth.app_id(
  'my_app_id',
  'my_user_id'
)

@aws_access_key_id = Vault.logical.read("secret/aws").data[:aws_access_key_id]
@aws_secret_access_key = Vault.logical.read("secret/aws").data[:aws_secret_access_key]

For both calls (even with the data attribute specified), I see the following in the audit log:

Nov  7 01:11:00 vagrant vault[2021]: 
{
    "time": "2015-11-07T01:11:00Z",
    "type": "response",
    "error": "",
    "auth": {
        "display_name": "",
        "policies": [
            "baseline"
        ],
        "metadata": {
            "app-id": "my_app_id",
            "user-id": "my_user_id"
        }
    },
    "request": {
        "operation": "read",
        "path": "secret/aws",
        "data": null,
        "remote_address": "127.0.0.1"
    },
    "response": {
        "secret": {
            "lease_id": ""
        },
        "data": {
            "aws_access_key_id": "foo",
            "aws_secret_access_key": "bar"
        },
        "redirect": ""
    }
}

The request hash line that says "data": null, makes me think it’s not reading my .data[:aws_access_key_id] attribute when it calls the read function, even though that line of code used to work (e.g. a day or two ago, without any changes to the code base). Should I just call Vault.logical.read("secret/aws") in my code, and then iterate over the data response hash in my recipe for the information I need? What’s the best way to pull out the “aws_access_key_id” and “aws_secret_access_key” values?

About this issue

Original URL
State: closed
Created 9 years ago
Comments: 21 (10 by maintainers)

Most upvoted comments

@sethvargo I ran puts Vault.logical.read("secret/aws").data in a ruby block in my Chef recipe, and it read the data correctly. So it looks like Vault was not returning the data correctly from the data hash. I updated my code to call the hash keys via the symbol (:key) method instead of the string ("key") method, and that worked:

chef_gem 'json'
chef_gem 'vault'
require 'json'
require 'vault'

Vault.address = "http://127.0.0.1:8200"
Vault.auth.app_id(
  "foo",
  "bar"
)

node.default['awscli']['aws_access_key_id'] = Vault.logical.read("secret/aws").data[:aws_access_key_id]
node.default['awscli']['aws_secret_access_key'] = Vault.logical.read("secret/aws").data[:aws_secret_access_key]

So it looks like Vault will only return keys from the data hash using the symbol method and not via the string method.

jcderose on Nov 8, 2015