How to Setup HashiCorp Vaulton Ubuntu & Use It for AWS RDS MySQL with Python

# Install prerequisites

sudo apt-get update
sudo apt-get install -y gpg wget lsb-release

# Add HashiCorp GPG key and repository

wget -O- https://apt.releases.hashicorp.com/gpg | \
  sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
  https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
  sudo tee /etc/apt/sources.list.d/hashicorp.list

# Install Vault

sudo apt-get update
sudo apt-get install -y vault
vault --version

# Install Certbot

sudo apt-get install -y certbot

# Request certificate (port 80 must be open)

sudo certbot certonly --standalone \
  -d vault.yourdomain.com \
  --non-interactive \
  --agree-tos \
  -m admin@yourdomain.com

# Copy certs to Vault TLS directory

sudo mkdir -p /opt/vault/tls

sudo cp /etc/letsencrypt/live/vault.yourdomain.com/fullchain.pem /opt/vault/tls/cert.pem
sudo cp /etc/letsencrypt/live/vault.yourdomain.com/privkey.pem /opt/vault/tls/key.pem

sudo chown vault:vault /opt/vault/tls/*.pem
sudo chmod 600 /opt/vault/tls/key.pem

# Auto-renewal hook (copies new certs + reloads Vault)

sudo tee /etc/letsencrypt/renewal-hooks/deploy/vault-reload.sh << 'EOF'
#!/bin/bash
cp /etc/letsencrypt/live/vault.yourdomain.com/fullchain.pem /opt/vault/tls/cert.pem
cp /etc/letsencrypt/live/vault.yourdomain.com/privkey.pem /opt/vault/tls/key.pem
chown vault:vault /opt/vault/tls/*.pem
chmod 600 /opt/vault/tls/key.pem
systemctl reload vault
EOF

sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/vault-reload.sh

# Test renewal

sudo certbot renew --dry-run

# Create data directory

sudo mkdir -p /opt/vault/data
sudo chown -R vault:vault /opt/vault

# /etc/vault.d/vault.hcl

storage "raft" {
  path    = "/opt/vault/data"
  node_id = "vault-prod-1"
}

listener "tcp" {
  address         = "0.0.0.0:8200"
  tls_cert_file   = "/opt/vault/tls/cert.pem"
  tls_key_file    = "/opt/vault/tls/key.pem"
  tls_min_version = "tls12"
}

seal "awskms" {
  region     = "us-east-1"
  kms_key_id = "arn:aws:kms:us-east-1:123456789012:key/your-key-id"
}

api_addr     = "https://vault.yourdomain.com:8200"
cluster_addr = "https://vault.yourdomain.com:8201"
ui           = true

# IAM policy for EC2 (attach to instance role)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:DescribeKey"
      ],
      "Resource": "arn:aws:kms:us-east-1:123456789012:key/your-key-id"
    }
  ]
}

# Start Vault

sudo systemctl enable vault
sudo systemctl start vault
sudo systemctl status vault

# Set Vault address

export VAULT_ADDR="https://vault.yourdomain.com:8200"

# Initialize (KMS auto-unseal mode)

vault operator init -recovery-shares=5 -recovery-threshold=3

# Check status (should show Sealed: false)

vault status

# Login with root token

vault login <ROOT_TOKEN>

vault write database/config/my-rds-mysql \
  plugin_name="mysql-database-plugin" \
  connection_url="{{username}}:{{password}}@tcp(my-rds.abc123.us-east-1.rds.amazonaws.com:3306)/" \
  allowed_roles="my-app-role" \
  username="vault_admin" \
  password="YourRDSAdminPassword"

# Request credentials

vault read database/creds/my-app-role

# Output

Key                Value
---                -----
lease_id           database/creds/my-app-role/abc123def456
lease_duration     1h
lease_renewable    true
password           A1a-xK9mLp2QrStUvWx
username           v-token-my-app-r-1234567890

# my-app-policy.hcl

path "database/creds/my-app-role" {
  capabilities = ["read"]
}

path "sys/leases/renew" {
  capabilities = ["update"]
}

path "auth/token/lookup-self" {
  capabilities = ["read"]
}

# Apply the policy

vault policy write my-app-policy my-app-policy.hcl

vault auth enable aws

# Map IAM role to Vault policy

vault write auth/aws/role/my-python-app \
  auth_type="iam" \
  bound_iam_principal_arn="arn:aws:iam::123456789012:role/my-python-app-role" \
  policies="my-app-policy" \
  ttl="1h"

# docker-compose.yml

version: "3.8"

services:
  vault-agent:
    image: hashicorp/vault:1.15
    command: vault agent -config=/etc/vault/agent.hcl
    volumes:
      - ./vault-agent.hcl:/etc/vault/agent.hcl:ro
      - ./templates:/etc/vault/templates:ro
      - secrets:/secrets
    environment:
      VAULT_ADDR: "https://vault.yourdomain.com:8200"

  python-app:
    build: .
    depends_on:
      - vault-agent
    ports:
      - "8000:8000"
    volumes:
      - secrets:/secrets:ro
    environment:
      DB_CREDS_FILE: "/secrets/db-creds.json"
      RDS_HOST: "my-rds.abc123.us-east-1.rds.amazonaws.com"
      RDS_DATABASE: "mydb"

volumes:
  secrets:

# vault-agent.hcl

vault {
  address = "https://vault.yourdomain.com:8200"
}

auto_auth {
  method "aws" {
    config = {
      type = "iam"
      role = "my-python-app"
    }
  }

  sink "file" {
    config = {
      path = "/secrets/.vault-token"
    }
  }
}

template {
  source      = "/etc/vault/templates/db-creds.tpl"
  destination = "/secrets/db-creds.json"
}

# templates/db-creds.tpl

{{ with secret "database/creds/my-app-role" }}
{
  "username": "{{ .Data.username }}",
  "password": "{{ .Data.password }}"
}
{{ end }}