@@ -90,7 +90,7 @@ $ curl \
90
90
91
91
The contents of ` data.json ` in this example are:
92
92
93
- ```
93
+ ``` json
94
94
{
95
95
"password" : " myPa55word" ,
96
96
"roles" : [ " vault" ],
@@ -108,7 +108,7 @@ Now, Elasticsearch is configured and ready to be used with Vault.
108
108
109
109
1 . Enable the database secrets engine if it is not already enabled:
110
110
111
- ``` text
111
+ ``` shell-session
112
112
$ vault secrets enable database
113
113
Success! Enabled the database secrets engine at: database/
114
114
```
@@ -118,7 +118,7 @@ Now, Elasticsearch is configured and ready to be used with Vault.
118
118
119
119
1 . Configure Vault with the proper plugin and connection information:
120
120
121
- ``` text
121
+ ``` shell-session
122
122
$ vault write database/config/my-elasticsearch-database \
123
123
plugin_name="elasticsearch-database-plugin" \
124
124
allowed_roles="internally-defined-role,externally-defined-role" \
@@ -135,25 +135,23 @@ Now, Elasticsearch is configured and ready to be used with Vault.
135
135
a privilege escalation by editing a role's privileges out-of-band in
136
136
Elasticsearch:
137
137
138
- ``` text
138
+ ``` shell-session
139
139
$ vault write database/roles/internally-defined-role \
140
140
db_name=my-elasticsearch-database \
141
141
creation_statements='{"elasticsearch_role_definition": {"indices": [{"names":["*"], "privileges":["read"]}]}}' \
142
142
default_ttl="1h" \
143
143
max_ttl="24h"
144
- Success! Data written to: database/roles/internally-defined-role
145
144
```
146
145
147
146
1 . Alternatively, configure a role that maps a name in Vault to a pre-existing
148
147
role definition in Elasticsearch:
149
148
150
- ``` text
149
+ ``` shell-session
151
150
$ vault write database/roles/externally-defined-role \
152
151
db_name=my-elasticsearch-database \
153
152
creation_statements='{"elasticsearch_roles": ["pre-existing-role-in-elasticsearch"]}' \
154
153
default_ttl="1h" \
155
154
max_ttl="24h"
156
- Success! Data written to: database/roles/externally-defined-role
157
155
```
158
156
159
157
## Usage
@@ -164,7 +162,7 @@ the proper permission, it can generate credentials.
164
162
1 . Generate a new credential by reading from the ` /creds ` endpoint with the name
165
163
of the role:
166
164
167
- ``` text
165
+ ``` shell-session
168
166
$ vault read database/creds/my-role
169
167
Key Value
170
168
--- -----
0 commit comments