AWS Secrets Manager vault

You can set up an AWS Secrets Manager vault in one of the following ways:

• Using the Vault entity
• Using environment variables, set at Kong Gateway startup
• Using parameters in kong.conf, set at Kong Gateway startup

The Vault entity can only be used once the database is initialized. Secrets for values that are used before the database is initialized can’t make use of the Vaults entity.

To access secrets stored in AWS Secrets Manager, Kong Gateway needs an IAM Role that has sufficient permissions to read the required secret values.

Kong Gateway can automatically fetch IAM role credentials based on your AWS environment, using the following precedence order:

1. Fetch from credentials defined in environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
2. Fetch from profile and credential file, defined by AWS_PROFILE and AWS_SHARED_CREDENTIALS_FILE.
3. Fetch from an ECS container credential provider.
4. Fetch from an EKS IAM roles for service account.
5. Fetch from EC2 IMDS metadata. Both v1 and v2 are supported.

Kong Gateway also supports role assuming using vaults.config.assume_role_arn and vaults.config.role_session_name, which lets you use a different IAM role to fetch secrets from AWS Secrets Manager. This is a common practice for permission division, governance, and cross-AWS account management.

Note: IAM Identity Center credential provider and process credential provider are not supported.

The following example creates an aws Vault entity in the AWS region us-east-1. The Vault name must be aws. The vault.prefix value can be your own custom prefix:

_format_version: "3.0"
vaults:
  - name: aws
    prefix: aws-vault
    description: Storing secrets in AWS Secrets Manager
    config:
      region: us-east-1

curl -i -X POST http://localhost:8001/vaults/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "aws",
      "prefix": "aws-vault",
      "description": "Storing secrets in AWS Secrets Manager",
      "config": {
        "region": "us-east-1"
      }
    }
    '

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/vaults/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "aws",
      "prefix": "aws-vault",
      "description": "Storing secrets in AWS Secrets Manager",
      "config": {
        "region": "us-east-1"
      }
    }
    '

echo "
apiVersion: configuration.konghq.com/v1alpha1
kind: KongVault
metadata:
  name: aws-vault
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
spec:
  backend: aws
  prefix: aws-vault
  description: Storing secrets in AWS Secrets Manager
  config:
    region: us-east-1
" | kubectl apply -f -

resource "konnect_gateway_vault" "my_vault" {
  prefix = "aws-vault"
  description = "Storing secrets in AWS Secrets Manager"
  config = {
    region = "us-east-1"
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}

The following table lists all of the available configuration parameters for an AWS Secrets Manager Vault:

• Configure AWS Secrets Manager as a vault backend View →