Integrate your Edge site with your vault

Integrate your CyberArk Vault with your Edge site connections by adding a vault to your Edge site.

You can connect to your CyberArk Vault using the following authentication methods:

• mTLS
• allow-list

Before you begin

• Ensure that your environment uses the latest user interface.
• Install your Edge site.
• You must have a CyberArk Vault .
• Your CyberArk Vault must be configured with either Allowed machines (allow-list) or Client certificates (mTLS).
• Your CyberArk Credential Provider must have GetPassword Web Service available in /AIMWebService.
• If you use a --caPath, it must be in the X.509 format (PEM encoded).
• If you use a --certPath, it must be in the X.509 format (PEM encoded).
• If you use a --keyPath, it must be in the PKCS#8 format (PEM encoded).
• You have installed and configured the Edge CLI tool.

Required permissions

• You can administer CyberArk secrets. This includes the ability to do the following in your CyberArk Vault :
  • Create
  • Edit
  • Delete
  • Rotate credentials
• You have access to both Edge management and your connections data sources that will use the vault credentials.

Steps

In the cluster where your Edge site is installed, use the Edge CLI tool to run the command for the mTLSallow-list authentication method.

./edgecli vault create cyber tls "<name>" \
  --desc "<description>" \
  --appId "<appId>" \
  --url "<url>" \
  --caPath "<caPath>" \
  --certPath "<certPath>" \
  --keyPath "<keyPath>"

./edgecli vault create cyber tls "Edge CyberArk Vault mTLS" \
  --desc "CyberArk vault with mTLS authentication." \
  --appId "edge" \
  --url "https://edge-cyberark-server.example.com" \
  --caPath "./certs/ca.crt" \
  --certPath "./certs/aimws.crt" \
  --keyPath "./certs/aimws-pkcs8.key"

./edgecli vault create cyber allow-list "<name>" \
  --desc "<description>" \
  --appId "<appId>" \
  --url "<url>" \
  --caPath "<caPath>"

./edgecli vault create cyber allow-list "Edge CyberArk allowlist" \
--desc "CyberArk vault with allowlist authentication." \
--appId "edge" \
--url "https://edge-cyberark-server.example.com" \
--caPath "./certs/ca.crt"

Your available vault integrations are visible on the Vaults tab of your Edge site.

./edgecli vault create "<vault>" "<authMethod>" -h

What's next?

• You can now set up an Edge connection with your CyberArk Vault .
• You can retrieve and review the configuration details of your vault integrations.
• You can edit your vault integration configuration.

Integrate your HashiCorp Vault with your Edge site connections by adding a vault to your Edge site.

Before you begin

• Ensure that your environment uses the latest user interface.
• Install your Edge site.
• You must have a HashiCorp Vault.
• If you use a --caPath, it must be in the X.509 format (PEM encoded).
• If you use a --certPath, it must be in the X.509 format (PEM encoded).
• If you use a --keyPath, it must be in the PKCS#8 format (PEM encoded).
• You have installed and configured the Edge CLI tool.

Required permissions

• You or another user can administer HashiCorp Vault secrets. This includes the ability to do the following in your HashiCorp Vault:
  • Create
  • Edit
  • Delete
  • Rotate credentials
• You or another user have read credentials to the Authentication method and the HashiCorp Vault secret engine.
• You have access to both Edge management and your connections data sources that will use the vault credentials.

Steps

In the cluster where your Edge site is installed, use the Edge CLI tool to run the command for the username and passwordTLS authentication method:

./edgecli vault create hashicorp user-pass "<name>" \
  --desc "<description>" \
  --user "<username>" \
  --pass "<password>" \
  --caPath "<caPath>" \
  --url "<url>"

./edgecli vault create hashicorp user-pass "user-pass-auth-endpoint" \
  --desc "HashiCorp vault with user-pass authentication." \
  --user "my-edge-site" \
  --pass "EdgePass123" \
  --caPath "~/hashicorp/vault/ca.pem" \
  --url "https://hashicorp-vault.edge.collibra/" \
  --name "Hasicorp Vault Username/Password AuthN"

./edgecli vault create hashicorp tls "<name>" \
  --authName "<authName>"
  --desc "<description>" \
  --caPath "<caPath>" \
  --certPath "<certPath>" \
  --keyPath "<keyPath>" \
  --url "<url>"

./edgecli vault create hashicorp tls "tls-vault-auth" \
  --authName "tls-vault-auth" \"
  --desc "HashiCorp vault with tls authentication." \
  --caPath "~/hashicorp/vault/ca.pem" \
  --certPath "~/hashicorp/vault/edge-site.crt" \
  --keyPath "~/hashicorp/vault/edge-site.key" \
  --url "https://hashicorp-vault.edge.collibra/"

Your available vault integrations are visible on the Vaults tab of your Edge site.

./edgecli vault create "<vault>" "<authMethod>" -h

What's next?

• You can now set up an Edge connection with your HashiCorp Vault .
• You can retrieve and review the configuration details of your vault integrations.
• You can edit your vault integration configuration.

Integrate your Azure Key Vault with your Edge site connections by adding a vault to your Edge site.

You can connect to your Azure Key Vault using the following authentication methods:

• Managed Identity assigned to Azure Virtual Machine
• Service Principal Secret
• Service Principal with PEM certificate
• Service Principal with PFX certificate

Before you begin

• Ensure that your environment uses the latest user interface.
• Install your Edge site.
  • In order to use the Managed Identity assigned to Azure Virtual Machine authentication method, you must install your Edge site inside of the Azure VM.
• You must have an Azure Key Vault.
• You must generate a client secret for the Azure Service Principal.
• You must generate a PEM certificate for the Azure Service Principal.
• You must generate a PFX certificate for the Azure Service Principal.
• Create secrets in your Azure Key Vault.
• You have installed and configured the Edge CLI tool.

Required permissions

• You have the following Azure Key Vault roles or permissions:
  • If you use Access Policies, you must have the Get and List Secret permissions.
  • If you use Access Control (IAM), you must have the Key Vault Secrets User role, or a role with similar permissions.
• You have a global role that has the Manage Edge sites global permission.
• You have access to both Edge management and your connections data sources that will use the vault credentials.
• You must assign the managed identity to the Azure VM.

Steps

In the cluster where your Edge site is installed, use the Edge CLI tool to run the command for the managed identity assigned to the Azure VMservice principal secretservice principal with PEM certificateservice Principal with PFX certificate authentication method.

./edgecli vault create azure managed-identity "<name>" \
  --desc "<description>" \
  --dnsSuffix "<dnsSuffix>"

./edgecli vault create azure managed-identity "Azure-managed-identity" \
  --desc "Azure Key vault with managed identity authentication." 
  --dnsSuffix "vault.azure.net"

./edgecli vault create azure sp-secret "<name>" \
  --desc "<description>" \
  --dnsSuffix "<dnsSuffix>" \
  --tenantId "<tenantId>" \
  --clientId "<clientId>" \
  --clientSecret "<clientSecret>"

./edgecli vault create azure sp-secret "Azure-service-principal" \
  --desc "Azure Key vault with service principal secret authentication." \
  --dnsSuffix "vault.azure.net" \
  --tenantId "165" \
  --clientId "AZ_22" \
  --clientSecret "Secret123" 

./edgecli vault create azure sp-pem "<name>" \
  --desc "<description>" \
  --dnsSuffix "<dnsSuffix>" \
  --tenantId "<tenantId>" \
  --clientId "<clientId>" \
  --certPath "<certPath>"

./edgecli vault create azure sp-secret "Azure-service-principal-PEM" \
  --desc "Azure Key vault with service principal with PEM cert authentication." \
  --dnsSuffix "vault.azure.net" \
  --tenantId "165" \
  --clientId "AZ_22" \
  --certPath "~/azurekey/vault/edge-site.pem"

./edgecli vault create azure sp-pfx "<name>" \
  --desc "<description>" \
  --dnsSuffix "<dnsSuffix>" \
  --tenantId "<tenantId>" \
  --clientId "<clientId>" \
  --certPath "<certPath>" \
  --certPassword "<certPassword>"

./edgecli vault create azure sp-secret "Azure-service-principal-PFX" \
  --desc "Azure Key vault with service principal with PFX cert authentication." \
  --dnsSuffix "vault.azure.net" \
  --tenantId "165" \
  --clientId "AZ_22" \
  --certPath "~/azurekey/vault/edge-site.pfx" \
  --certPassword "AZ_PFX_password1"

Your available vault integrations are visible on the Vaults tab of your Edge site.

./edgecli vault create "<vault>" "<authMethod>" -h

What's next?

• You can now set up an Edge connection with your Azure Key Vault .
• You can retrieve and review the configuration details of your vault integrations.
• You can edit your vault integration configuration.

Integrate your AWS Secrets Manager with your Edge site connections by adding a Vault to your Edge site.

You can connect to your AWS Secrets Manager using the following authentication methods:

• IAM Access Key
• Instance Profile
• Assume Role
  • Assume Role is similar to Instance Profile, but allows you to narrow down the access to your vault to a singe role.

Before you begin

• Ensure that your environment uses the latest user interface.
• Install your Edge site.
  • If you are using the Instance Profile authentication method, your Edge site must be running on an EC2 or EKS instance assigned to an Instance Profile that has access to the AWS Secrets Manager you want to connect to.
  • If you are using the Assume Role authentication method, your Edge site must be running on an EC2 or EKS instance assigned to an Instance Profile that with access to role that has read access to the AWS Secrets Manager you want to connect to.
• You have a AWS Secrets Manager.
• Create secrets in your AWS Secrets Manager.
  • If you are using the IAM Access Key authentication method, you must create IAM credentials with read access to the AWS Secrets Manager where your Edge site secrets will be stored.
• You have installed and configured the Edge CLI tool.

Note Forward proxies are not supported for AWS Secrets Manager integrations. You must have a direct connection to your AWS Secrets Manager.

Required permissions

• You have a global role that has the Manage connections and capabilities global permission.
• Your Edge site has network access to the AWS Secrets Manager endpoints.
• You have access to both Edge management and your connections data sources that will use the vault credentials.

Steps

In the cluster where your Edge site is installed, use the Edge CLI tool to run the command for the IAM access keyinstance profileassume role authentication method.

./edgecli vault create aws key-secret "<name>" \
  --desc="<description>" \
  --region="<region>" \
  --endpointOverride="<endpointOverride>" \
  --accessKeyId="<accessKeyId>" \
  --accessKey="<accessKey>"

./edgecli vault create aws key-secret "AWS-IAM" \
  --desc="AWS vault with IAM Access Key authentication." \
  --region="eu-west-1" \
  --endpointOverride="http://my-secret-vault.aws.com" \
  --accessKeyId="1234" \
  --accessKey="abcd"

./edgecli vault create aws instance-profile "<name>" \
  --desc="<description>" \
  --region="<region>" \
  --endpointOverride="<endpointOverride>"

./edgecli vault create aws instance-profile "AWS-Instance" \
  --desc="AWS vault with Instant Profile authentication" \
  --region="eu-west-1" \
  --endpointOverride="http://my-secret-vault.aws.com"

./edgecli vault create aws assume-role "<name>" \
  --desc="<description>" \
  --roleArn="<roleArn>"
  --roleSessionName="<roleSessionName>"
  --region="<region>"\
  --endpointOverride="<endpointOverride>"

./edgecli vault create aws instance-profile "AWS-Assume" \
  --desc="AWS vault with Assume Role authentication" \
  --roleArn="edge-session"
  --roleSessionName="edge-session"
  --region="eu-west-1" \
  --endpointOverride="http://my-secret-vault.aws.com"

Your available vault integrations are visible on the Vaults tab of your Edge site.

./edgecli vault create "<vault>" "<authMethod>" -h

What's next?

• You can now set up an Edge connection with your AWS Secrets Manager .
• You can retrieve and review the configuration details of your vault integrations.
• You can edit your vault integration configuration.

Integrate your Google Secret Manager with your Edge site connections by adding a vault to your Edge site.

You can connect to your Google Secret Manager using the following authentication methods:

• IAM Role assigned to the Google Cloud Engine VM
• Service Account JSON Key
• Service Account P12 Key

Before you begin

• Ensure that your environment uses the latest user interface.
• Install your Edge site.
  • In order to use the IAM Role assigned to the Google Cloud Engine VM authentication method, you must install your Edge site inside of the Google Cloud Engine VM.
• You must have a Google Cloud account.
• You must generate a JSON key for the Google Service Account.
• You must generate P12 key for Google Service Account.
  Note P12 is a deprecated key type for backwards compatibility. The steps provided in Google's documentation about creating access credentials are intended for JSON. You can still follow the same steps for P12, with the only difference being the selection of the P12 Key Type instead of JSON.
• You must create secrets in your Google Secret Manager.
• You have installed and configured the Edge CLI tool.

Required permissions

• Your Google Secret Manager account must have the following permissions:
  • iam.serviceAccounts.getAccessToken
  • resourcemanager.projects.get
  • secretmanager.secrets.get
  • secretmanager.secrets.getIamPolicy
  • secretmanager.secrets.list
  • secretmanager.versions.access
  • secretmanager.versions.get
  • secretmanager.versions.list
• You must assign a Google Service Account to the Google Cloud Engine VM where your Edge site secrets will be stored.
• Your Edge site has network access to the Google Secret Manager endpoints.
• You have access to both Edge management and your connections data sources that will use the vault credentials.

Steps

In the cluster where your Edge site is installed, use the Edge CLI tool to run the command for the IAM role assigned to the Google Cloud Engine VMJSON keyP12 key authentication method.

./edgecli vault create gcp iam-role "<name>" \
  --desc="<description>" \
  --projectId="<projectId>"

./edgecli vault create gcp iam-role "GCP-IAM" \
  --desc="GCP vault with IAM Role assigned to the Google Cloud Engine VM authentication" \
  --projectId="IAM_145"

./edgecli vault create gcp sa-json "<name>" \
  --desc="<description>" \
  --projectId="<projectId>" \
  --keyPath="<keyPath>"

./edgecli vault create gcp sa-json "GCP-JSON" \
  --desc="GCP Secret Manager vault with JSON Key authentication" \
  --projectId="JSON_145" \
  --keyPath="~/GCP/vault/edge-site.json"

./edgecli vault create gcp sa-p12 "<name>" \
  --desc="<description>" \
  --projectId="<projectId>" \
  --keyPath="<keyPath>" \
  --keyPassword="<keyPassword>" \
  --emailAddress="<emailAddress>"

./edgecli vault create gcp sa-p12 "GCP-P12" \
  --desc="GCP Secret Manager vault with Service Account P12 Key authentication" \
  --projectId="P12_145" \
  --keyPath="/GCP/vault/edge-site.p12" \
  --keyPassword="GCP_edge_vault_password" \
  --emailAddress="[email protected]"

Your available vault integrations are visible on the Vaults tab of your Edge site.

./edgecli vault create "<vault>" "<authMethod>" -h

What's next?

• You can now set up an Edge connection with your Google Secret Manager .
• You can retrieve and review the configuration details of your vault integrations.
• You can edit your vault integration configuration.