Control Group

​

What Are Control Groups?

1. The token’s attached ACL policies
2. Any Sentinel policies applied to the token or path

​

Control Group Factors

• ACL policies
• Sentinel policies

​

Control Group Workflow

1. Client requests a secret at the protected path.
2. Vault returns a wrapping token instead of the secret.
3. Client shares the wrapping token’s accessor with the approvers.
4. Approvers submit the accessor back to Vault to authorize the request.
5. Once all approvals are met, the client runs vault unwrap to retrieve the secret.

​

1. Client Receives a Wrapping Token

{
  "wrap_info": {
    "token":    "hvs.CAESIPvNkRgluUVNT_ccLsm6aZ-",
    "accessor": "cql9n3r4kMeIQZekoLrMWMWN",
    "ttl":      300
    // ...
  }
}

​

2. Approvers Authorize the Request

vault write sys/control-group/authorize accessor="cql9n3r4kMeIQZekoLrMWMWN"

​

3. Client Unwraps the Secret

vault unwrap hvs.CAESIPvNkRgluUVNT_ccLsm6aZ-

​

Defining Control Groups in ACL Policies

path "kv/data/customers/orders" {
  capabilities = ["read"]

  control_group = {
    factor "acct_manager" {
      identity {
        group_names = ["account-managers"]
        approvals   = 2
      }
    }
  }
}

​

Defining Control Groups in Sentinel Policies

import "controlgroup"

control_group = func() {
  numAuthzs = 0
  for controlgroup.authorizations as authz {
    if "account-managers" in authz.groups.by_name {
      numAuthzs = numAuthzs + 1
    }
  }
  return numAuthzs >= 2
}

main = rule {
  control_group()
}

​

Demo: Control Groups in Action

1. Authenticate with a token that has a control-group policy:
   vault login hvs.CAESIA7Y-LwSxnE926onQwdxlUF7w7KJ5-
   
2. Request the secret:
   vault kv get kv/customers/orders
   
3. Share the wrapping_accessor with approvers and await authorization.
4. Unwrap the token once all approvals are in place:
   vault unwrap hvs.H5IATHFed2Aqk5RsW1eEF4d
   

​

Conclusion

​

References

• Vault ACL Policies
• Sentinel Control Groups
• Vault Wrapping API
• Vault Identity Groups