HashiCorp Vault Associate (003) Question 14
Single answer1b Choose an authentication method based on use caseA company uses Vault Enterprise to manage database credentials for several internal applications. One new application runs on a fleet of ephemeral virtual machines in AWS Auto Scaling groups. The security team wants each instance to authenticate to Vault without storing a long-lived secret on disk and without requiring a human to log in. Which authentication method is the best fit for this use case?
- A
Enable the AWS auth method so instances can authenticate using their AWS identity
- B
Use the userpass auth method and distribute a shared username and password to all instances at boot time
- C
Use the token auth method and bake a periodic root token into the machine image
- D
Use the LDAP auth method because it centralizes authentication for all systems and users
Show answer and explanation
Correct answer: A
Explanation
For machine authentication, the best practice is to choose an auth method tied to the platform's native identity rather than distributing static credentials. In AWS, the AWS auth method allows Vault to validate instance or IAM-based identity, which makes it appropriate for ephemeral EC2 instances in Auto Scaling groups. Human-focused methods such as userpass or LDAP are better suited to interactive user logins, while token auth is only appropriate when the token is obtained securely from another trusted process and is scoped minimally. Using a root token for applications is explicitly discouraged. This aligns with Vault documentation and common guidance to use platform-based auth methods for applications and to minimize long-lived secrets.
- A. Correct.
Correct. The AWS auth method is designed for workloads running in AWS and lets Vault verify AWS instance or IAM identity. This avoids storing a long-lived credential on disk and is well suited for ephemeral EC2 instances in Auto Scaling groups. It is a common machine-auth pattern for cloud-native workloads.
- B. Incorrect.
Incorrect. The userpass auth method is intended for human users, not fleets of machines. Distributing a shared username and password to instances creates a static secret management problem and weakens auditability because many instances would authenticate as the same principal.
- C. Incorrect.
Incorrect. Baking a root token into an image is a severe security anti-pattern. Root tokens are highly privileged and should not be used by applications. More broadly, pre-distributing long-lived tokens to ephemeral instances does not meet the requirement to avoid long-lived secrets on disk.
- D. Incorrect.
Incorrect. LDAP auth is typically used for human authentication by integrating Vault with a centralized directory. It does not solve the workload identity problem for ephemeral AWS instances and would still require managing credentials for machines.