Announcing Secure HashiCorp Vault Access With Aembit Workload IAM

• Eliminate the secret zero problem

Typically when applications come online for the first time, they need a bootstrap secret in order to access the Vault. This initial secret is typically sent out-of-band – that is, a human needs to manually deliver the secret or devs need to build a secondary capability to deliver it – and enable the application to access Vault. This bootstrap secret is a risk to your organization: not only does it present a risk if someone gets a hold of it, but the manual processes involved mean that the secret may exist in many places in addition to the application itself (like chat, email or elsewhere). With Aembit, no bootstrap secret is needed. Our identity-based access management capabilities mean that Aembit can provide Vault access for a new application using environmental metadata such as a service account token to attest to its identity, combined with a policy that permits its access.

• Eliminate complex Vault integration

HashiCorp Vault is powerful, but oftentimes complex to operate in a secure and consistent manner. The Aembit Edge simplifies how you integrate vault into your environment by providing the ability to do no-code auth. The Edge sits next to your applications, as a sidecar in K8s or as an agent in a virtual machine, and enables you to run your Vault with no further integration into your workload. Upon each request from a workload to your Vault, the Edge transparently intercepts requests, and works with the Aembit Cloud to validate its identity and its access rights. Upon approval, Aembit Cloud mints a short-lived access token that allows the workload to access vault with the right permissions and sends it back to the Edge. Finally, Edge injects the token into the request and forwards it to your Vault. One more win here? Your application never sees – and never stores – the Vault access credential. This radically reduces key sprawl and your risk of stolen credentials.

• Implement conditional access to Vault

With Aembit protecting your environment, we can also provide conditional access to your Vault based on elements beyond a validated identity. This allows you to assess the posture of your workload before they access your critical data. For example, today you can check if a workload is being actively managed or secured by Wiz or CrowdStrike as part of an access policy before providing a credential to the requestor. Aembit plans to regularly introduce new forms of conditional access to give you both a flexible and also a comprehensive approach to assessing the security of your workloads.