HashiCorp Vault Associate (003) Question 2
Single answer1 Authentication methodsA company is moving several internal applications to HashiCorp Vault. The security team wants each application instance running on AWS EC2 to authenticate to Vault without storing long-lived Vault tokens in configuration files. They also want Vault to verify the instance identity using AWS-provided metadata rather than relying on a shared secret distributed to every server. Which authentication method is the best fit for this requirement?
- A
Enable the AppRole auth method and distribute the same role_id and secret_id to every EC2 instance
- B
Enable the AWS auth method and have the EC2 instances authenticate using their AWS identity
- C
Enable the userpass auth method and create one Vault username/password per application instance
- D
Enable the token auth method and bake periodic service tokens into the AMI used by the EC2 instances
Show answer and explanation
Correct answer: B
Explanation
The best answer is the AWS auth method because it is purpose-built for workloads running in AWS and supports identity-based authentication using AWS-provided information. In this scenario, the team wants to avoid distributing Vault credentials such as static tokens or shared secrets and instead have Vault validate the instance's AWS identity. That is exactly the kind of problem the AWS auth method is meant to solve.
By contrast, AppRole is a valid machine authentication method in many environments, but it typically involves distributing a secret_id through some secure process. That does not match the requirement to rely on AWS-provided metadata or identity. Userpass is primarily for human authentication, and pre-baked tokens are a common anti-pattern because they create credential sprawl and increase exposure risk.
HashiCorp documentation and best practices generally recommend choosing an auth method that matches the platform's native identity system whenever possible. For AWS-hosted workloads, the AWS auth method is the most appropriate fit for platform-integrated authentication.
- A. Incorrect.
Incorrect. AppRole is commonly used for machine authentication, but this option does not meet the stated requirement well because it relies on distributing a shared secret_id to instances. The scenario specifically asks for Vault to verify instance identity using AWS-provided metadata rather than a shared secret. While AppRole can be used securely in some workflows, using the same role_id and secret_id across all instances weakens identity assurance and secret management.
- B. Correct.
Correct. The AWS auth method is designed for workloads running in AWS. It allows Vault to authenticate EC2 instances or IAM principals by validating AWS identity information. This aligns with the requirement to avoid long-lived Vault tokens in files and to let Vault verify the workload's identity using AWS mechanisms instead of a manually distributed shared secret.
- C. Incorrect.
Incorrect. The userpass auth method is intended for human users authenticating with a username and password, not for ephemeral application instances. Creating and managing separate usernames and passwords for each EC2 instance is operationally poor and does not use AWS-native identity verification.
- D. Incorrect.
Incorrect. Token auth can authenticate directly with a Vault token, but baking tokens into an AMI creates a long-lived credential distribution problem. Even periodic tokens still represent pre-issued Vault credentials stored on the instance image, which conflicts with the requirement to avoid storing long-lived Vault tokens in configuration or images and does not leverage AWS identity verification.