Skip to content

Commit 6a2297e

Browse files
backport of commit 17740fc (hashicorp#20529)
Co-authored-by: Jens Hofmann <je.hof@web.de>
1 parent df689dc commit 6a2297e

File tree

1 file changed

+6
-8
lines changed

1 file changed

+6
-8
lines changed
 

‎website/content/docs/secrets/databases/elasticdb.mdx

+6-8
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ $ curl \
9090

9191
The contents of `data.json` in this example are:
9292

93-
```
93+
```json
9494
{
9595
"password" : "myPa55word",
9696
"roles" : [ "vault" ],
@@ -108,7 +108,7 @@ Now, Elasticsearch is configured and ready to be used with Vault.
108108

109109
1. Enable the database secrets engine if it is not already enabled:
110110

111-
```text
111+
```shell-session
112112
$ vault secrets enable database
113113
Success! Enabled the database secrets engine at: database/
114114
```
@@ -118,7 +118,7 @@ Now, Elasticsearch is configured and ready to be used with Vault.
118118

119119
1. Configure Vault with the proper plugin and connection information:
120120

121-
```text
121+
```shell-session
122122
$ vault write database/config/my-elasticsearch-database \
123123
plugin_name="elasticsearch-database-plugin" \
124124
allowed_roles="internally-defined-role,externally-defined-role" \
@@ -135,25 +135,23 @@ Now, Elasticsearch is configured and ready to be used with Vault.
135135
a privilege escalation by editing a role's privileges out-of-band in
136136
Elasticsearch:
137137

138-
```text
138+
```shell-session
139139
$ vault write database/roles/internally-defined-role \
140140
db_name=my-elasticsearch-database \
141141
creation_statements='{"elasticsearch_role_definition": {"indices": [{"names":["*"], "privileges":["read"]}]}}' \
142142
default_ttl="1h" \
143143
max_ttl="24h"
144-
Success! Data written to: database/roles/internally-defined-role
145144
```
146145

147146
1. Alternatively, configure a role that maps a name in Vault to a pre-existing
148147
role definition in Elasticsearch:
149148

150-
```text
149+
```shell-session
151150
$ vault write database/roles/externally-defined-role \
152151
db_name=my-elasticsearch-database \
153152
creation_statements='{"elasticsearch_roles": ["pre-existing-role-in-elasticsearch"]}' \
154153
default_ttl="1h" \
155154
max_ttl="24h"
156-
Success! Data written to: database/roles/externally-defined-role
157155
```
158156

159157
## Usage
@@ -164,7 +162,7 @@ the proper permission, it can generate credentials.
164162
1. Generate a new credential by reading from the `/creds` endpoint with the name
165163
of the role:
166164

167-
```text
165+
```shell-session
168166
$ vault read database/creds/my-role
169167
Key Value
170168
--- -----

0 commit comments

Comments
 (0)