Skip to main content
Version: Next

Step 3 - Required Secrets in Secret Manager

MongoDB connection string​

To enable CDR Platform Policy API to create and manage the policies in MongoDB, the connection string of the MongoDB should be created in the SecretsManager

  • You can retrieve the connection string of the DocumentDB(Mongodb complatible) from the AWS Console which looks as shown in the example below.
mongodb://${username}:${password}@${endpoint}:${port}/?ssl=true&ssl_ca_certs=rds-combined-ca-bundle.pem&replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false
  • Enter your connection string (highlighted in the screenshot) by replacing ${mongodb_connstring}, and enter your AWS region by replacing ${region} (as below).
aws secretsmanager create-secret --name "mongodb-connectionstring" --secret-string "${mongodb_connstring}" --region "${region}"

Add the MongoDB passwords to AWS Secret Manager as a secret​

Note: If you have previously configured and setup MongoDB within AWS and have created your MongoDB connection string as listed above, you can skip this step.

If not, to enable Glasswall Halo's Policy API to create and manage the policies in MongoDB, and Async API to create and manage the requests, MongoDB needs to be deployed using Helm charts listed in Step 8.

Two users will be created by the MongoDB Helm chart and the corresponding user's password needs to be set in the Vault secret.

Sensitive data, such as passwords, should be in the AWS Secrets Manager.

aws secretsmanager create-secret --name "mongodb-cdrp-password" --secret-string "<cdrp-user-password>" --region "${region}"
aws secretsmanager create-secret --name "mongodb-admin-password" --secret-string "<admin-user-password>" --region "${region}"

Amazon DocumentDB Certificate Authority (CA)​

For the cdrplatform-policy-api service to successfully authenticate to MongoDB, it should trust the Amazon DocumentDB Certificate Authority.

  • Create a secret with name cdrp-rds-ca-bundle in SecretsManager with the content of Certificate Authority provided by Amazon

Reversing Labs credentials (Optional)​

To integrate the Halo with Reversing Labs, add the credentials of the Reversing Labs to the AWS Secrets Manager. Replace ${reversinglabs_username} and ${reversinglabs_password} with actual username and password.

aws secretsmanager create-secret  --name "halo-reversinglabs-username" --secret-string "${reversinglabs_username}" --region "${region}"
aws secretsmanager create-secret  --name "halo-reversinglabs-password" --secret-string "${reversinglabs_password}" --region "${region}"

ICAP MTLS certificates (Optional)​

ICAP servers can be configured for mutual client authentication using the MTLS certificates. The certificates will be mounted to the ICAP server pods using the Kubernetes secrets. Add the server certificates and certificate authority to the AWS secrets manager so that they can be synced to Kubernetes secrets.

aws secretsmanager create-secret --name "tls-server-cert" --region "${region}" --secret-string <file://path/to/mtls-server-cert.pem>
aws secretsmanager create-secret --name "tls-server-key" --region "${region}" --secret-string <file://path/to/mtls-server-key.pem>
aws secretsmanager create-secret --name "tls-cafile" --region "${region}" --secret-string <file://path/to/mtls-ca-cert.pem>