Salesforce

Credential Vault Options for Data Sources

Printable View
« Go Back
Information
Credential Vault Options for Data Sources
UUID-26d6548b-897a-c516-646d-c85689ab3e79
Article Content

OneTrust Data Discovery offers several credential store options when configuring and deploying worker nodes for data sources. Data source credentials are stored in a local vault and only referenced to perform scans. They are never sent to the OneTrust Cloud.

For more information on this module's security and encryption practices, please reference Data Discovery Security Guide. For specifics on HashiCorp Vault, see HashiCorp Key Vault Configuration.

Selecting Credential Stores

During guided worker node setup, you will be asked to choose the associated credential store and supply key details like region, keys, URLs, etc. For more information on this step in worker node creation, see Guided Worker Node Installation Overview.

credential-store.png

AWS Secrets Manager

Note

The IAM account used for accessing AWS Secrets Manager should not have multi-factor authentication (MFA) enabled.

Secret name must contain only alphanumeric characters and the characters /_+=.@-.

Field

Description

AWS Region

Enter the name of region associated with the data cluster centers.

Example: us-east-1

Access Key

Enter the access key associated with the AWS user account.

Example: AKIAIOSFODNN7EXAMPLE

Secret Access Key

Enter the secret access key associated with the AWS user account.

Example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Optional: Deploy with Native Authentication

Enable the Deploy with Native Authentication to delegate permissions using IAM role(s) in order to make API requests that fetch credentials. The secretsmanager:GetSecretValue permission has to be attached to the role in order to fetch the secrets.

Field

Description

AWS Region

Enter the name of region associated with the data cluster centers.

Example: us-east-1

  1. If you have AWS EKS with Nodegroup Infrastructure, the getSecretValue permission must be attached as a policy to the Node IAM role found at Elastic Kubernetes Service > Cluster > Compute.

  2. AWS Fargate deployment currently does not support the Native Authentication feature.

Azure Key Vault

Note

Secret names can only contain alphanumeric characters and dashes.

Field

Description

Azure Key Vault URL

Enter the URL to the vault. Typically appended with .vault.azure.net

Example: https://workspace123.vault.azure.net

Azure Key Vault Tenant ID

Enter the directory ID associated with the application.

Azure Key Vault Client ID (masked)

Enter the application (client) ID associated with the application.

Example: 627e991e-43cd-61d5-992e-12db9c81b413

Azure Key Vault Client Secret (masked)

Enter the key vault client secret.

CyberArk Conjur

Field

Description

Appliance URL (Required)

Enter the URL of the Conjur appliance to which you are connecting.

Account (Required)

Enter the organization account assigned during the Conjur appliance installation.

Login (Required)

Enter the fully-qualified ID of a Conjur host for the service broker.

API Key (Required)

Enter the API Key of the Conjur host whose identity you provided in the Login field.

Account Type

Enter the account type. Variable is selected by default.

Google Secret Manager

Field

Description

Google Credentials

Enter the JSON credentials created in the GCP account to authenticate and authorize calls.

Standard Format

projects/{projectId}/secrets/{secretId}/versions/{versionId}

Example

projects/<data-discovery-306320-Project id>/secrets/<Secretname -S3>/versions/latest

HashiCorp Vault - Open Source (Internal)

If selected, OneTrust will install the HashiCorp Vault locally in order to store credential details of the data source(s). For configuration guidance, see HashiCorp Key Vault Configuration.

HashiCorp Vault - Open Source (External)

Field

Description

HashiCorp Vault URL

Enter the URL to the external vault.

HashiCorp Vault Token (masked)

Enter the token to the external vault. This is used to connect to the vault.

HashiCorp Vault Key (masked)

Enter the master key to the external vault. This is used to unseal the vault.

HashiCorp Vault - Enterprise

Token Auth

Field

Description

HashiCorp Vault URL

Enter the URL to the enterprise vault.

HashiCorp Vault Namespace

Enter the namespace for the enterprise vault.

HashiCorp Vault Authentication

Select the Token authentication method to gain access to the vault.

HashiCorp Vault Token (masked)

Enter the vault token to the enterprise vault.

AppRole Authentication

Field

Description

HashiCorp Vault URL

Enter the URL to the enterprise vault.

HashiCorp Vault Namespace

Enter the namespace for the enterprise vault.

HashiCorp Vault Authentication

Select the AppRole authentication method to gain access to the vault.

HashiCorp Vault Role

Enter the Vault role. The AppRole authentication method allows machines or apps to authenticate with Vault-defined roles.

HashiCorp Vault Role ID

Enter the Role ID of the AppRole.

HashiCorp Vault Secret ID

Enter the Secret ID issued against the AppRole.

HashiCorp Vault Role Path

Enter the vault role path.

Note

For more information on the policy configuration for AppRole authentication, see the HashiCorp Enterprise AppRole Policy section in HashiCorp Key Vault Configuration.
 
Article Visibility
12,005
Translation
English
Checked
Powered by