HashiCorp Vault Associate (003) Question 4
Single answer1 Authentication methodsA company runs multiple internal applications on virtual machines in AWS and wants each application instance to authenticate to HashiCorp Vault without storing long-lived Vault tokens on disk. The security team also wants Vault to verify the identity of the AWS instance at login time and issue short-lived client tokens automatically. Which authentication method is the best fit for this requirement?
- A
Enable the AWS auth method and have the applications authenticate using the EC2 or IAM-based login flow
- B
Enable the userpass auth method and create a shared username and password for all application instances
- C
Enable the token auth method and bake a periodic root token into the application AMI
- D
Enable the LDAP auth method and have each application bind to Vault with a service account password stored in an environment variable
Show answer and explanation
Correct answer: A
Explanation
The best answer is the AWS auth method because it is purpose-built for workloads running in AWS. It lets Vault authenticate applications based on AWS-provided identity information, such as EC2 instance identity or IAM-signed requests, and then issue Vault tokens with policies tied to a Vault role. This matches the scenario's goals: no long-lived Vault tokens on disk, validation of AWS identity at login, and automatic issuance of short-lived client tokens. By contrast, userpass and LDAP rely on static credentials, which are harder to manage securely for machines, and token auth with embedded tokens is specifically discouraged for production workloads. This aligns with HashiCorp Vault best practices around using platform identity-based auth methods for machines whenever possible and minimizing static secret distribution.
- A. Correct.
Correct. The AWS auth method is designed for workloads running in AWS and allows Vault to validate AWS identity during login. In practice, an application can authenticate using the EC2 or IAM login flow, and Vault then issues a Vault token based on the mapped role. This avoids distributing long-lived Vault tokens and aligns with the requirement for identity verification at login time and short-lived issued tokens.
- B. Incorrect.
Incorrect. The userpass auth method is intended for human users or simple testing scenarios, not for cloud workload identity. A shared username and password across instances creates credential sprawl and does not let Vault verify the AWS instance identity directly. It also introduces long-lived static credentials that the scenario is trying to avoid.
- C. Incorrect.
Incorrect. While token auth exists, baking a long-lived or highly privileged token into an AMI is a major security anti-pattern. A root token should be tightly controlled and not used by applications. This option also fails the requirement that Vault verify the AWS instance identity at login time.
- D. Incorrect.
Incorrect. LDAP can be appropriate for authenticating human users against a directory, but it is not the best fit for AWS machine identity. Storing an LDAP service account password in an environment variable still relies on static credentials, and Vault is not validating the EC2 instance identity through AWS in this approach.