Vault Hardening

# vault.hcl - Auto-Unseal Configuration
seal "awskms" {
  region     = "eu-central-1"
  kms_key_id = "arn:aws:kms:eu-central-1:123456789:key/vault-unseal"
}

# Or Azure Key Vault
seal "azurekeyvault" {
  client_id     = ""
  client_secret = ""
  tenant_id     = ""
  vault_name    = "vault-keys"
  key_name      = "unseal-key"
}

# GCP Cloud KMS
seal "gcpckms" {
  project    = "my-project"
  region     = "europe-west1"
  key_ring   = "vault-keys"
  crypto_key = "unseal-key"
}

# vault.hcl - TLS Configuration
listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_cert_file = "/etc/vault/vault.crt"
  tls_key_file  = "/etc/vault/vault.key"
  
  # TLS 1.3 only
  tls_min_version = "tls13"
  
  # Require client certs for admin
  tls_require_and_verify_client_cert = false
  tls_client_ca_file = "/etc/vault/ca.crt"
  
  # Ciphers
  tls_cipher_suites = "TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256"
  
  # HSTS
  x_forwarded_for_authorized_addrs = ["10.0.0.0/8"]
  x_forwarded_for_hop_skips = 1
}

# Disable UI if not needed (API only)
ui = false

# Enable Kubernetes auth
vault auth enable kubernetes

# Configure JWT validation
vault write auth/kubernetes/config   token_reviewer_jwt="@/var/run/secrets/kubernetes.io/serviceaccount/token"   kubernetes_host="https://$KUBERNETES_PORT_443_TCP_ADDR:443"   kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

# Create role for service account
vault write auth/kubernetes/role/app-role   bound_service_account_names=app   bound_service_account_namespaces=production   policies=app-read   ttl=1h

# Policy: Read specific secrets
path "secret/data/app/*" {
  capabilities = ["read"]
}

# Business Hours Only
import "time"

allowed_time = rule {
    time.now.weekday > 0 and time.now.weekday < 6 and
    time.now.hour > 8 and time.now.hour < 18
}

main = rule {
    allowed_time
}

# Require MFA for admin
import "strings"

mfa_required = rule when request.operation in ["create", "update", "delete"] {
    strings.has_prefix(request.path, "secret/admin") == false or
    request.mfa_methods contains "totp"
}

main = rule {
    mfa_required
}