Package: django-vault-helpers
This is a helper library with the goal of making it easier to retrieve secrets from Hasicorp Vault from a Django project.InstallationInstalldjango-vault-helpersfrom pip.$ pip install django-vault-helpersAdd the new packages to your installed apps.INSTALLED_APPS = [
    ...
    'vaulthelpers',
    ...
]Authenticating to VaultConfigure connection settings using environment variables to authenticate to Vault.Environment VariableDescriptionVAULT_URLRequired. The URL of the Vault API. For example,https://vault:8200/.VAULT_CACERTOptional. File path to the Vault CA certificate.VAULT_SKIP_VERIFYOptional. Set to disable validation of Vault’s SSL cert.VAULT_DEBUGOptional. Enable Vault debug logging.In addition to the settings above, you must provide environment variables for one of the authentication methods below.Environment VariableDescriptionVAULT_TOKENToken for Vault Token authenticationVAULT_APPID, VAULT_USERIDApp-ID authenticationVAULT_ROLEID, VAULT_SECRETIDApp-Role authenticationVAULT_SSLCERT, VAULT_SSLKEYSSL Client Cert authenticationDatabase Connection SecretsTo use Vault to load database connection configuration and credentials, configure the Vault database secret backend as described in theDatabase secret backend documentation. For example:$ vault mount database
Successfully mounted 'database' at 'database'!
$ CONNECTION_NAME='myapplication'
$ CONNECTION_URL='postgresql://vaultuser:FOO@mydb:5432/myapplication'
$ PARENT_ROLE_NAME='myapplication'
$ vault write "database/config/$CONNECTION_NAME" \
        plugin_name="postgresql-database-plugin" \
        allowed_roles="$CONNECTION_NAME" \
        connection_url="$CONNECTION_URL"
$ vault write "database/roles/$CONNECTION_NAME" \
        db_name="$CONNECTION_NAME" \
        creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN ENCRYPTED PASSWORD '{{password}}' VALID UNTIL '{{expiration}}' IN ROLE \"${PARENT_ROLE_NAME}\" INHERIT NOCREATEROLE NOCREATEDB NOSUPERUSER NOREPLICATION;" \
        default_ttl="1h" \
        max_ttl="24h"Next, add settings via the following environment variables.Environment VariableDescriptionVAULT_DATABASE_PATHVault path to read from when fetching database credentials.
For example,database/creds/myapplication.DATABASE_URLDatabase connection string, sans the username and password.
For example,postgres://mydb:5432/myapplication.DATABASE_OWNERROLEFor PostgreSQL, the name of the role to assume after
connecting usingSET ROLEFinally, edit your projectssettings.pyfile to load database configuration using Vault.import vaulthelpers

# Load database credentials from Vault
DATABASES = {
    'default': vaulthelpers.database.get_config(),
}To add additional keys to the database configuration, pass in a dictionary to theget_configcall. For example:import vaulthelpers

# Load database credentials from Vault
DATABASES = {
    'default': vaulthelpers.database.get_config({
        'ATOMIC_REQUESTS': True,
        'CONN_MAX_AGE': 3600,
    }),
}AWS CredentialsTo use Vault to load IAM or STS credentials for AWS, configure the Vault AWS secret backend as described in theAWS secret backend documentation.$ vault mount aws
Successfully mounted 'aws' at 'aws'!
$ vault write aws/config/root \
        access_key=AKIAJWVN5Z4FOFT7NLNA \
        secret_key=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 \
        region=us-east-1
$ vault write aws/roles/myapplication \
        arn=arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:role/MyApplicationRoleNameNext, add settings via the following environment variables.Environment VariableDescriptionVAULT_AWS_PATHVault path to read from when fetching AWS credentials.
For example,aws/sts/myapplication.Finally, configure you Django project to load AWS credentials using Vault. To do this, edit thesettings.pyfile to include the following line.import vaulthelpers

# Load AWS credentials from Vault
vaulthelpers.aws.init_boto3_credentials()This will override the credential resolve code inboto3andbotocoreso that it will fetch credentials from Vault instead of the usual means, like environment variables or the EC2 metadata service.Direct HVAC Client AccessTo directly access the authenticationhvacclient connector, fetch it from thevaulthelpers.commonmodule.import vaulthelpers

vault_auth = vaulthelpers.common.get_vault_auth()
verify = vaulthelpers.common.VAULT_CACERT or vaulthelpers.common.VAULT_SSL_VERIFY
vcl = vault_auth.authenticated_client(vaulthelpers.common.VAULT_URL, verify=verify)
result = vcl.read('secret/data/apps/myaplication')
print(result)Changelog0.8.1Fix bug in DatabaseCredentialProvider.fetch_lease_ttl which sometimes caused Vault to panic when looking up lease TTLs.0.8.0Add background daemon threads that attempt to automatically renew leases for the cached Vault token and the DB credential lease.Add management command to revoke the cached Vault token.0.7.0Add support for AWS IAM and Kubernetes auth methodsAdd more verbose logging to database module to help debug connection failures0.6.0Add support for Django 2.1Add support for Python 3.7Migrate from Sentry’s old SDK (raven) to their new SDK (sentry-sdk).0.5.0Cache database and AWS credentials on the file system so that a multi-threaded / multi-process system doesn’t need separate credentials for each process and thread.Improve security by setting the file permissions of all cache files (vault token, AWS, database) to only be readable by the owner.0.4.2Fix Django 2.0 Deprecation warnings.0.4.1Fix bug with SET ROLE when using the PostGIS database wrapper.0.4.0Fix bug with Database credential fetch code when a lease appears to still be valid but isn’t, due to it’s parent token getting revoked.Added tests for database and AWS components.Dropped dependencies on12factor-vaultanddjango-postgresql-setrole. When upgrading to this version, it is recommended to uninstall these packages.0.3.3Fix bug in with passing url parameter to HVAC client incommon.EnvironmentConfigImprove testing.Support Django 2.00.3.2Prevent recycling TCP connections after forking a process.0.3.1Fixed TCP connection issue by caching VaultAuthenticator instance in thread local storage.0.3.0Add file system caching of vault tokens.0.2.0Add S3 storage backend based onstorages.backends.s3boto3.S3Boto3Storage.0.1.0Initial release.