RabbitMQ database secrets engine

RabbitMQ is one of the supported plugins for the database secrets engine. This plugin generates RabbitMQ user credentials dynamically based on configured permissions and virtual hosts, so services that need to access a virtual host no longer need to hardcode credentials.

With every service accessing the messaging queue with unique credentials, auditing is much easier when questionable data access is discovered. Easily track issues down to a specific instance of a service based on the RabbitMQ username.

OpenBao makes use of both its own internal revocation system and RabbitMQ user deletion to ensure that users become invalid within a reasonable time of the lease expiring.

See the database secrets engine docs for more information about setting up the database secrets engine.

Capabilities

Plugin Name	Root Credential Rotation	Dynamic Roles	Static Roles	Username Customization
rabbitmq-database-plugin	Yes	Yes	Yes	Yes

Setup

1. Enable the database secrets engine if it is not already enabled:

   $ bao secrets enable database
   Success! Enabled the database secrets engine at: database/

   By default, the secrets engine will enable at the name of the engine. To enable the secrets engine at a different path, use the -path argument.

2. Configure OpenBao with the proper plugin and connection information. The OpenBao user must have the administrator management tag to manage other users:

   $ bao write database/config/my-rabbitmq-database \
       plugin_name="rabbitmq-database-plugin" \
       allowed_roles="my-role" \
       connection_uri="http://localhost:15672" \
       username="admin" \
       password="password"
   Success! Data written to: database/config/my-rabbitmq-database

3. Configure a role that maps a name in OpenBao to a creation_statements JSON document describing the tags, virtual host permissions, and topic permissions to grant:

   $ bao write database/roles/my-role \
       db_name="my-rabbitmq-database" \
       creation_statements='{"tags":"management","vhosts":{"/":{"write":".*","read":".*"}}}' \
       default_ttl="1h" \
       max_ttl="24h"
   Success! Data written to: database/roles/my-role

   creation_statements requires at least one of tags or vhosts. vhost_topics is optional. By default, no tags, virtual hosts, or topic permissions are assigned. If no topic permissions are defined and the default authorization backend is used, publishing to a topic exchange or consuming from a topic is always authorized. You can read more about RabbitMQ management tags and RabbitMQ topic authorization.

Usage

After the secrets engine is configured and a user/machine has an OpenBao token with the proper permission, it can generate credentials.

1. Generate a new credential by reading from the /creds endpoint with the name of the role:

   $ bao read database/creds/my-role
   Key                Value
   ---                -----
   lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
   lease_duration     1h
   lease_renewable    true
   password           SsnoaA-8Tv4t34f41baD
   username           v-token-my-role-x

API

The full list of configurable options can be seen on the RabbitMQ database plugin API page.

For more information on the database secrets engine's HTTP API please see the Database secrets engine API page.