Pushing Vault Accounts to Cloud Providers

In addition to pulling secrets from the cloud, Kron PAM can push Vault-managed accounts to AWS Secrets Manager, Azure Key Vault, or Google Cloud Secret Manager. This direction reuses the existing Application Trigger feature and works the same way as other Application Trigger strategies, operating on dynamic accounts.

Secrets > Configurations > Application Configurations gains three new strategies: Amazon Web Services, Microsoft Azure, and Google Cloud Platform. For all three, the account list in step 2 (Properties) is populated from the Administration > Cloud Integration accounts that have the Vault switch enabled for that provider.

·         Vault Account: dropdown, the Vault account to be pushed to AWS Secrets Manager.

·         Region: text, the AWS region of the target Secrets Manager.

·         Vault Account: dropdown, the Vault account to be pushed to Azure Key Vault.

·         Azure Key Vault URI, Azure Key Vault Name, and Region: text, identifying the target Key Vault.

·         Vault Account: dropdown, the Vault account to be pushed to GCP Secret Manager.

·         Project ID: text.

·         Location: dropdown, Automatic (Google replicates automatically across multiple regions) or Regional (a specific region is chosen).

·         Region: text, shown only when Location is set to Regional.

Saving a trigger definition does not push anything on its own. As with the other Application Trigger strategies, the push is driven by the password lifecycle of the selected account. When the password of the selected dynamic Vault account changes, whether through periodic rotation, rotation after checkout, or a manual password change, a Trigger Process record is created for the matching trigger definition with the initial status Waiting.

These waiting records are processed by the AapmTriggerProcessJob job, defined in Administration > Jobs Scheduler > Trigger List, which writes the new password value to the target AWS Secrets Manager, Azure Key Vault, or Google Cloud Secret Manager. A waiting record can also be processed immediately by selecting it on the Trigger Processes tab and clicking Continue. Regardless of how many trigger definitions exist, running a single Trigger Processes job is enough to run all of them. This job is independent of the VaultCloudSecretsSyncJob used for the pull direction, and the two are scheduled separately.