Secrets Management

To facilitate SSH scanning of a fleet of instances, Mondoo integrates with several vault systems:

• AWS Secrets Manager
• AWS SSM Parameter Store
• Google Cloud Secrets Manager
• GCP Berglas
• HashiCorp Vault
• macOS Keychain
• Windows credential store
• SystemD Secret Service
• Encrypted File

Each vault is configured in your inventory file's spec.vault block, and assets reference its secrets by secret_id. For the full schema and every vault type's options, read Vault integration in the inventory file reference.

HashiCorp Vault

Create a vault secret:

vault kv put secret/vcenter/mondoo-read password="< password >" type="password" user="mondoo-read@vsphere.local"

Reference it from your inventory file's spec.vault:

spec:
  assets:
    - name: vsphere-env
      connections:
        - type: vsphere
          host: < ip of the ESXi or vCenter >
          insecure: true
          credentials:
            - secret_id: vcenter/mondoo-read
  vault:
    name: cnspec-hashivault
    type: hashicorp-vault
    options:
      url: < Url to vault >
      token: < Token >

Encrypted file

Configure cnspec's vault to use an encrypted file for secrets:

cnspec vault configure mondoo-client-vault --type encrypted-file --option=password='changeme' --option path='/etc/opt/mondoo/vault.enc'

Then add a secret to it:

sudo cnspec vault add-secret vcenter '{ "type": "password", "user": "chris@vsphere.local", "password": "password" }' --inventory-file /etc/opt/mondoo/inventory.yml

For the full encrypted-file options and how to reference the resulting secret from an asset, read Configure a vault from the CLI in the inventory file reference.