{"action":"created","comment":{"url":"https://api.github.com/repos/hashicorp/vault/pulls/comments/60283950","id":60283950,"diff_hunk":"@@ -0,0 +1,1187 @@\n+---\n+layout: \"docs\"\n+page_title: \"Auth Backend: AWS EC2\"\n+sidebar_current: \"docs-auth-aws\"\n+description: |-\n+  The AWS EC2 backend allows automated authentication of AWS EC2 instances.\n+---\n+\n+# Auth Backend: AWS EC2\n+\n+The AWS EC2 auth backend provides a secure introduction mechanism for AWS EC2\n+instances, allowing automated retrieval of a Vault token.  Unlike most Vault\n+authentication backends, this backend does not require first deploying or\n+provisioning security-sensitive credentials (tokens, username/password, client\n+certificates, etc). Instead, it treats AWS as a Trusted Third Party and uses\n+the cryptographically signed dynamic metadata information that uniquely\n+represents each EC2 instance.\n+\n+## Authentication Workflow\n+\n+EC2 instances have access to metadata describing the instance. (For those not\n+familiar with instance metadata, details can be found\n+[here](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html).)\n+\n+One piece of \"dynamic metadata\" available to the EC2 instance is the instance\n+identity document, a JSON representation of a collection of instance metadata.\n+Importantly, AWS also provides a copy of this metadata in PKCS#7 format signed\n+with its public key, and publishes the public keys used (which are grouped by\n+region). (Details on the instance identity document and the signature can be\n+found\n+[here](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html).)\n+\n+During login, the backend verifies the signature on the PKCS#7 document,\n+ensuring that the information contained within is certified accurate by AWS.\n+Before succeeding the login attempt and returning a Vault token, the backend\n+verifies the current running status of the instance via the EC2 API.\n+\n+There are various modifications to this workflow that provide more or less\n+security, as detailed later in this documentation.\n+\n+## Authorization Workflow\n+\n+The basic mechanism of operation is per-AMI. AMI IDs are registered in the\n+backend and associated with various optional restrictions, such as the set of\n+allowed policies and max TTLs on the generated tokens.\n+\n+In many cases, an organization will use a \"seed AMI\" that is specialized after\n+bootup by configuration management or similar processes. For this reason, an\n+AMI entry in the backend can also be associated with a \"role tag\". These tags\n+are generated by the backend and are placed as the value of a tag with the\n+given key on the EC2 instance. The role tag can be used to further restrict the\n+parameters set on the image, but cannot be used to grant additional privileges.\n+\n+The role tags can be generated at will by an operator with appropriate API\n+access. They are HMAC-signed by a key stored within the backend, allowing the\n+backend to verify the authenticity of a found role tag and ensure that it has\n+not been tampered with. There is also a mechanism to blacklist role tags if one\n+has been found to be distributed outside of its intended set of machines.\n+\n+Role tags can also be scoped to a single instance ID, if the instance ID is\n+known ahead of time (for instance, by creating an instance but not yet starting\n+it, or starting the client on the instance after adding the role tag to the\n+instance). This allows an operator to ensure that the role tag cannot simply be\n+transferred from one instance to another. Even so, a particular set of\n+permissions for an AMI should always be the least acceptable subset of\n+permissions for any such machines; role tags should be considered opportunistic\n+restrictions, as they can still be added or removed from instances during\n+runtime. More foolproof segregation can be achieved by building multiple unique\n+AMIs, even if the configuration is the same.\n+\n+## Client Nonce\n+\n+If an unintended party gains access to the PKCS#7 signature of the identity\n+document (which by default is available to every process and user that gains\n+access to an EC2 instance), it can impersonate that instance and fetch a Vault\n+token. The backend addresses this problem by using a Trust On First Use (TOFU)\n+mechanism that allows the first client to present the document to be\n+authenticated and denying the rest. An important property of this design is\n+detection of unauthorized access: if an unintended party authenticates, the\n+intended client will be unable to authenticate and can raise an alert for\n+investigation.\n+\n+During the first login, the backend stores the instance ID that authenticated\n+in a `whitelist`. One method of operation of the backend is to disallow any\n+authentication attempt for an instance ID contained in the whitelist. However,\n+this has consequences for token rotation, as it means that once a token has\n+expired, subsequent authentication attempts would fail.\n+\n+The backend addresses this problem by sharing the responsibility with clients.\n+In the default method of operation, the client supplies a unique nonce during\n+the first authentication attempt, storing this nonce in the client's memory for\n+future use. This nonce is stored in the whitelist, tied to the instance ID.\n+Subsequent authentication attempts by the client require the nonce to match;\n+since only the original client knows the nonce, only the original client is\n+allowed to reauthenticate. (This is the reason that this is a whitelist rather\n+than a blacklist; by default, it's keeping track of clients allowed to\n+reauthenticate, rather than those that are not.) \n+\n+It is up to the client to behave correctly with respect to the nonce; if the\n+client stores the nonce on disk it can survive reboots, but could also give\n+access to other users or applications on the instance. It is also up to the\n+operator to ensure that client nonces are in fact unique; sharing nonces allows\n+a compromise of the nonce value to enable an attacker that gains access to any\n+EC2 instance to imitate the legitimate client on that instance. This is why\n+nonces can be disabled on the backend side in favor of only a single\n+authentication per instance; in some cases, such as when using ASGs, instances\n+are immutable and single-boot anyways, and in conjunction with a high max TTL,\n+reauthentication may not be needed (and if it is, the instance can simply be\n+shut down and allow ASG to start a new one).\n+\n+In both cases, entries can be removed from the whitelist by instance ID,\n+allowing reauthentication by a client if the nonce is lost (or not used) and an\n+operator approves the process.\n+\n+One other point: if available by the OS/distribution being used with the EC2\n+instance, it is not a bad idea to firewall access to the signed PKCS#7 metadata\n+to ensure that it is accessible only to the matching user(s) that require\n+access.\n+\n+## Advanced Options and Caveats\n+\n+### Dynamic Management of Policies Via Role Tags\n+\n+If the instance is required to have customized set of policies based on the\n+role it plays, the `role_tag` option can be used to provide a tag to set on\n+instances with the given AMI. When this option is set, during login, along with\n+verification of PKCS#7 signature and instance health, the backend will query\n+for the value of a specific tag with the configured key that is attached to the\n+instance. The tag holds information that represents a subset of privileges that\n+are set on the AMI and are used to further restrict the set of the AMI's\n+privileges for that particular instance.\n+\n+A `role_tag` can be created using `auth/aws/image/<ami_id>/roletag` endpoint\n+and is immutable. The information present in the tag is SHA256 hashed and HMAC\n+protected. The key to HMAC is only maintained in the backend. This prevents an\n+adversarial operator from modifying the tag when setting it on the EC2 instance\n+in order to escalate privileges.\n+\n+When the `role_tag` option is set on an AMI, failure to provide any role tag at\n+all results in a login failure. If the role tag has no policy component, the\n+client will inherit the allowed policies set on the AMI. If the role tag has a\n+policy component but it contains no policies, the token will contain only the\n+`default` policy; by default, this policy allows only manipulation (revocation,\n+renewal, lookup) of the existing token, plus access to its\n+[cubbyhole](https://www.vaultproject.io/docs/secrets/cubbyhole/index.html).\n+This can be useful to allow instances access to a secure \"scratch space\" for\n+storing data (via the token's cubbyhole) but without granting any access to\n+other resources provided by or resident in Vault.\n+\n+### Handling Lost Client Nonces\n+\n+If an EC2 instance loses its client nonce (due to a reboot, a stop/start of the\n+client, etc.), subsequent login attempts will not succeed. If the client nonce\n+is lost, normally the only option is to delete the entry corresponding to the\n+instance ID from the identity `whitelist` in the backend. This can be done via\n+the `auth/aws/whitelist/identity/<instance_id>` endpoint. This allows a new\n+client nonce to be accepted by the backend during the next login request.\n+\n+Under certain circumstances there is another useful setting. When the instance\n+is placed onto a host upon creation, it is given a `pendingTime` value in the\n+instance identity document (documentation from AWS does not cover this option,\n+unfortunately). If an instance is stopped and started, the `pendingTime` value\n+is updated (this does not apply to reboots, however).\n+\n+The backend can take advantage of this via the `allow_instance_migration`\n+option, which is set per-AMI. When this option is enabled, if the client nonce\n+does not match the saved nonce, the `pendingTime` value in the instance\n+identity document will be checked; if it is newer than the stored `pendingTime`\n+value, the backend assumes that the client was stopped/started and allows the\n+client to log in successfully, storing the new nonce as the valid nonce for\n+that client. This essentially re-starts the TOFU mechanism any time the\n+instance is stopped and started, so should be used with caution. Just like with\n+initial authentication, the legitimate client should have a way to alert (or an\n+alert should trigger based on its logs) if it is denied authentication.\n+\n+Unfortunately, the `allow_instance_migration` only helps during stop/start\n+actions; the current metadata does not provide for a way to allow this\n+automatic behavior during reboots. The backend will be updated if this needed\n+metadata becomes available.\n+\n+### Disabling Reauthentication\n+\n+If in a given organization's architecture a client fetches a long-lived Vault\n+token and has no need to rotate the token, all future logins for that instance\n+ID can be disabled. If the option `disallow_reauthentication` is set, only one\n+login will be allowed per instance.  If the intended client successfully\n+retrieves a token during login, it can be sure that its token will not be\n+hijacked by another entity.\n+\n+When `disallow_reauthentication` option is enabled, the client can choose not\n+to supply a nonce during login, although it is not an error to do so (the nonce\n+is simply ignored).\n+\n+The `disallow_reauthentication` option is set per-AMI, and can also be\n+specified in a role tag. Since role tags can only restrict behavior, if the\n+option is set to `false` on the AMI, a value of `true` in the role tag takes\n+effect; however, if the option is set to `true` on the AMI, a value set in the\n+role tag has no effect.\n+\n+### Blacklisting Role Tags\n+\n+Role tags are tied to a specific AMI, but the backend has no control over which\n+instances using that AMI should have any particular role tag; that is purely up\n+to the operator. Although role tags are only restrictive, if a role tag is\n+found to have been used incorrectly, and the administrator wants to ensure that\n+the role tag has no further effect, the role tag can be placed on a `blacklist`\n+via the endpoint `auth/aws/blacklist/roletag/<role_tag>`. Note that this will\n+not invalidate the tokens that were already issued; this only blocks any\n+further login requests.\n+\n+### Expiration Times and Tidying of `blacklist` and `whitelist` Entries\n+\n+The entries in both identity `whitelist` and role tag `blacklist` are not\n+deleted automatically, as the amount of time they are required to be valid are\n+likely to vary with organizational policy. The entries in both of these lists\n+contain an expiration time which is dynamically determined by three factors:\n+`max_ttl` set on the AMI, `max_ttl` set on the role tag, and `max_ttl` value of\n+the backend mount. The least of these three dictates the maximum TTL of the\n+issued token, and correspondingly will be set as the expiration times of these\n+entries.\n+\n+The endpoints `aws/auth/whitelist/identity/tidy` and\n+`aws/auth/blacklist/roletag/tidy` are provided to clean up the entries present\n+in these lists. These endpoints allow defining a safety buffer, such that an\n+entry must not only be expired, but be past expiration by the amount of time\n+dictated by the safety buffer in order to actually remove the entry.\n+\n+### Varying Public Certificates\n+\n+The AWS public certificate which contains the public key used to verify the\n+PKCS#7 signature varies for groups of regions. The default public certificate\n+provided with the backend is applicable many regions. Users of instances whose\n+signatures cannot be verified by the default public certificate, can register a\n+different public certificate which can be found [here]\n+(http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html),\n+via the `auth/aws/config/certificate/<cert_name>` endpoint.\n+\n+## Authentication\n+\n+### Via the CLI\n+\n+#### Enable AWS EC2 authentication in Vault.\n+\n+```\n+$ vault auth-enable aws\n+```\n+\n+#### Configure the credentials required to make AWS API calls\n+\n+Note: the client uses the official AWS SDK and will use environment variable or\n+IAM role-provided credentials if available.\n+\n+```\n+$ vault write auth/aws/config/client secret_key=vCtSM8ZUEQ3mOFVlYPBQkf2sO6F/W7a5TVzrl3Oj access_key=VKIAJBRHKH6EVTTNXDHA\n+```\n+\n+#### Configure the policies on the AMI.\n+\n+```\n+$ vault write auth/aws/image/ami-fce3c696 policies=prod,dev max_ttl=500h\n+```\n+\n+#### Perform the login operation\n+\n+```\n+$ vault write auth/aws/login pkcs7=MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAaCAJIAEggGmewogICJkZXZwYXlQcm9kdWN0Q29kZXMiIDogbnVsbCwKICAicHJpdmF0ZUlwIiA6ICIxNzIuMzEuNjMuNjAiLAogICJhdmFpbGFiaWxpdHlab25lIiA6ICJ1cy1lYXN0LTFjIiwKICAidmVyc2lvbiIgOiAiMjAxMC0wOC0zMSIsCiAgImluc3RhbmNlSWQiIDogImktZGUwZjEzNDQiLAogICJiaWxsaW5nUHJvZHVjdHMiIDogbnVsbCwKICAiaW5zdGFuY2VUeXBlIiA6ICJ0Mi5taWNybyIsCiAgImFjY291bnRJZCIgOiAiMjQxNjU2NjE1ODU5IiwKICAiaW1hZ2VJZCIgOiAiYW1pLWZjZTNjNjk2IiwKICAicGVuZGluZ1RpbWUiIDogIjIwMTYtMDQtMDVUMTY6MjY6NTVaIiwKICAiYXJjaGl0ZWN0dXJlIiA6ICJ4ODZfNjQiLAogICJrZXJuZWxJZCIgOiBudWxsLAogICJyYW1kaXNrSWQiIDogbnVsbCwKICAicmVnaW9uIiA6ICJ1cy1lYXN0LTEiCn0AAAAAAAAxggEXMIIBEwIBATBpMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQwIJAJa6SNnlXhpnMAkGBSsOAwIaBQCgXTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjA0MDUxNjI3MDBaMCMGCSqGSIb3DQEJBDEWBBRtiynzMTNfTw1TV/d8NvfgVw+XfTAJBgcqhkjOOAQDBC4wLAIUVfpVcNYoOKzN1c+h1Vsm/c5U0tQCFAK/K72idWrONIqMOVJ8Uen0wYg4AAAAAAAA nonce=vault-client-nonce\n+```\n+\n+\n+### Via the API\n+\n+#### Enable AWS EC2 authentication in Vault.\n+\n+```\n+curl -X POST -H \"x-vault-token:123\" \"http://127.0.0.1:8200/v1/sys/auth/aws\" -d '{\"type\":\"aws\"}'\n+```\n+\n+#### Configure the credentials required to make AWS API calls.\n+\n+```\n+curl -X POST -H \"x-vault-token:123\" \"http://127.0.0.1:8200/v1/auth/aws/config/client\" -d '{\"access_key\":\"VKIAJBRHKH6EVTTNXDHA\", \"secret_key\":\"vCtSM8ZUEQ3mOFVlYPBQkf2sO6F/W7a5TVzrl3Oj\"}'\n+```\n+\n+#### Configure the policies on the AMI.\n+\n+```\n+curl -X POST -H \"x-vault-token:123\" \"http://127.0.0.1:8200/v1/auth/aws/image/ami-fce3c696\" -d '{\"policies\":\"prod,dev\",\"max_ttl\":\"500h\"}'\n+```\n+\n+#### Perform the login operation\n+\n+```\n+curl -X POST \"http://127.0.0.1:8200/v1/auth/aws/login\" -d '{\"pkcs7\":\"MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAaCAJIAEggGmewogICJkZXZwYXlQcm9kdWN0Q29kZXMiIDogbnVsbCwKICAicHJpdmF0ZUlwIiA6ICIxNzIuMzEuNjMuNjAiLAogICJhdmFpbGFiaWxpdHlab25lIiA6ICJ1cy1lYXN0LTFjIiwKICAidmVyc2lvbiIgOiAiMjAxMC0wOC0zMSIsCiAgImluc3RhbmNlSWQiIDogImktZGUwZjEzNDQiLAogICJiaWxsaW5nUHJvZHVjdHMiIDogbnVsbCwKICAiaW5zdGFuY2VUeXBlIiA6ICJ0Mi5taWNybyIsCiAgImFjY291bnRJZCIgOiAiMjQxNjU2NjE1ODU5IiwKICAiaW1hZ2VJZCIgOiAiYW1pLWZjZTNjNjk2IiwKICAicGVuZGluZ1RpbWUiIDogIjIwMTYtMDQtMDVUMTY6MjY6NTVaIiwKICAiYXJjaGl0ZWN0dXJlIiA6ICJ4ODZfNjQiLAogICJrZXJuZWxJZCIgOiBudWxsLAogICJyYW1kaXNrSWQiIDogbnVsbCwKICAicmVnaW9uIiA6ICJ1cy1lYXN0LTEiCn0AAAAAAAAxggEXMIIBEwIBATBpMFwxCzAJBgNVBAYTAlVTMRkwFwYDVQQIExBXYXNoaW5ndG9uIFN0YXRlMRAwDgYDVQQHEwdTZWF0dGxlMSAwHgYDVQQKExdBbWF6b24gV2ViIFNlcnZpY2VzIExMQwIJAJa6SNnlXhpnMAkGBSsOAwIaBQCgXTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjA0MDUxNjI3MDBaMCMGCSqGSIb3DQEJBDEWBBRtiynzMTNfTw1TV/d8NvfgVw+XfTAJBgcqhkjOOAQDBC4wLAIUVfpVcNYoOKzN1c+h1Vsm/c5U0tQCFAK/K72idWrONIqMOVJ8Uen0wYg4AAAAAAAA\",\"nonce\":\"ault-client-nonce\"}'","path":"website/source/docs/auth/aws.html.md","position":null,"original_position":293,"commit_id":"1a5deeec0622c23193c042e29969ed4bad5c5392","original_commit_id":"58ad2ec8c67009ffc0980028eb98f8727d79abe4","user":{"login":"vishalnayak","id":3053672,"avatar_url":"https://avatars.githubusercontent.com/u/3053672?v=3","gravatar_id":"","url":"https://api.github.com/users/vishalnayak","html_url":"https://github.com/vishalnayak","followers_url":"https://api.github.com/users/vishalnayak/followers","following_url":"https://api.github.com/users/vishalnayak/following{/other_user}","gists_url":"https://api.github.com/users/vishalnayak/gists{/gist_id}","starred_url":"https://api.github.com/users/vishalnayak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vishalnayak/subscriptions","organizations_url":"https://api.github.com/users/vishalnayak/orgs","repos_url":"https://api.github.com/users/vishalnayak/repos","events_url":"https://api.github.com/users/vishalnayak/events{/privacy}","received_events_url":"https://api.github.com/users/vishalnayak/received_events","type":"User","site_admin":false},"body":"Thanks! Fixed.","created_at":"2016-04-19T18:23:17Z","updated_at":"2016-04-19T18:23:17Z","html_url":"https://github.com/hashicorp/vault/pull/1300#discussion_r60283950","pull_request_url":"https://api.github.com/repos/hashicorp/vault/pulls/1300","_links":{"self":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/comments/60283950"},"html":{"href":"https://github.com/hashicorp/vault/pull/1300#discussion_r60283950"},"pull_request":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/1300"}}},"pull_request":{"url":"https://api.github.com/repos/hashicorp/vault/pulls/1300","id":65394703,"html_url":"https://github.com/hashicorp/vault/pull/1300","diff_url":"https://github.com/hashicorp/vault/pull/1300.diff","patch_url":"https://github.com/hashicorp/vault/pull/1300.patch","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/1300","number":1300,"state":"open","locked":false,"title":"AWS EC2 instances authentication backend","user":{"login":"vishalnayak","id":3053672,"avatar_url":"https://avatars.githubusercontent.com/u/3053672?v=3","gravatar_id":"","url":"https://api.github.com/users/vishalnayak","html_url":"https://github.com/vishalnayak","followers_url":"https://api.github.com/users/vishalnayak/followers","following_url":"https://api.github.com/users/vishalnayak/following{/other_user}","gists_url":"https://api.github.com/users/vishalnayak/gists{/gist_id}","starred_url":"https://api.github.com/users/vishalnayak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vishalnayak/subscriptions","organizations_url":"https://api.github.com/users/vishalnayak/orgs","repos_url":"https://api.github.com/users/vishalnayak/repos","events_url":"https://api.github.com/users/vishalnayak/events{/privacy}","received_events_url":"https://api.github.com/users/vishalnayak/received_events","type":"User","site_admin":false},"body":"This supersedes #805, #828, and #948 in that this is the backend that we will be officially supporting and enhancing going forward.","created_at":"2016-04-06T00:44:33Z","updated_at":"2016-04-19T18:23:17Z","closed_at":null,"merged_at":null,"merge_commit_sha":"4222b28f284084a48c325490520f5152c29ddaa3","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/hashicorp/vault/pulls/1300/commits","review_comments_url":"https://api.github.com/repos/hashicorp/vault/pulls/1300/comments","review_comment_url":"https://api.github.com/repos/hashicorp/vault/pulls/comments{/number}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/1300/comments","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/1a5deeec0622c23193c042e29969ed4bad5c5392","head":{"label":"hashicorp:aws-auth-backend","ref":"aws-auth-backend","sha":"1a5deeec0622c23193c042e29969ed4bad5c5392","user":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars.githubusercontent.com/u/761456?v=3","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"repo":{"id":31288958,"name":"vault","full_name":"hashicorp/vault","owner":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars.githubusercontent.com/u/761456?v=3","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/hashicorp/vault","description":"A tool for managing secrets.","fork":false,"url":"https://api.github.com/repos/hashicorp/vault","forks_url":"https://api.github.com/repos/hashicorp/vault/forks","keys_url":"https://api.github.com/repos/hashicorp/vault/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hashicorp/vault/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hashicorp/vault/teams","hooks_url":"https://api.github.com/repos/hashicorp/vault/hooks","issue_events_url":"https://api.github.com/repos/hashicorp/vault/issues/events{/number}","events_url":"https://api.github.com/repos/hashicorp/vault/events","assignees_url":"https://api.github.com/repos/hashicorp/vault/assignees{/user}","branches_url":"https://api.github.com/repos/hashicorp/vault/branches{/branch}","tags_url":"https://api.github.com/repos/hashicorp/vault/tags","blobs_url":"https://api.github.com/repos/hashicorp/vault/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/vault/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/vault/git/refs{/sha}","trees_url":"https://api.github.com/repos/hashicorp/vault/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/{sha}","languages_url":"https://api.github.com/repos/hashicorp/vault/languages","stargazers_url":"https://api.github.com/repos/hashicorp/vault/stargazers","contributors_url":"https://api.github.com/repos/hashicorp/vault/contributors","subscribers_url":"https://api.github.com/repos/hashicorp/vault/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/vault/subscription","commits_url":"https://api.github.com/repos/hashicorp/vault/commits{/sha}","git_commits_url":"https://api.github.com/repos/hashicorp/vault/git/commits{/sha}","comments_url":"https://api.github.com/repos/hashicorp/vault/comments{/number}","issue_comment_url":"https://api.github.com/repos/hashicorp/vault/issues/comments{/number}","contents_url":"https://api.github.com/repos/hashicorp/vault/contents/{+path}","compare_url":"https://api.github.com/repos/hashicorp/vault/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hashicorp/vault/merges","archive_url":"https://api.github.com/repos/hashicorp/vault/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hashicorp/vault/downloads","issues_url":"https://api.github.com/repos/hashicorp/vault/issues{/number}","pulls_url":"https://api.github.com/repos/hashicorp/vault/pulls{/number}","milestones_url":"https://api.github.com/repos/hashicorp/vault/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/vault/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hashicorp/vault/labels{/name}","releases_url":"https://api.github.com/repos/hashicorp/vault/releases{/id}","deployments_url":"https://api.github.com/repos/hashicorp/vault/deployments","created_at":"2015-02-25T00:15:59Z","updated_at":"2016-04-19T09:30:54Z","pushed_at":"2016-04-19T18:21:56Z","git_url":"git://github.com/hashicorp/vault.git","ssh_url":"git@github.com:hashicorp/vault.git","clone_url":"https://github.com/hashicorp/vault.git","svn_url":"https://github.com/hashicorp/vault","homepage":"https://www.vaultproject.io/","size":14634,"stargazers_count":4437,"watchers_count":4437,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":401,"mirror_url":null,"open_issues_count":164,"forks":401,"open_issues":164,"watchers":4437,"default_branch":"master"}},"base":{"label":"hashicorp:master","ref":"master","sha":"28c97b49146bb5b8ffba59959674ab39db70e8cd","user":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars.githubusercontent.com/u/761456?v=3","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"repo":{"id":31288958,"name":"vault","full_name":"hashicorp/vault","owner":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars.githubusercontent.com/u/761456?v=3","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/hashicorp/vault","description":"A tool for managing secrets.","fork":false,"url":"https://api.github.com/repos/hashicorp/vault","forks_url":"https://api.github.com/repos/hashicorp/vault/forks","keys_url":"https://api.github.com/repos/hashicorp/vault/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hashicorp/vault/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hashicorp/vault/teams","hooks_url":"https://api.github.com/repos/hashicorp/vault/hooks","issue_events_url":"https://api.github.com/repos/hashicorp/vault/issues/events{/number}","events_url":"https://api.github.com/repos/hashicorp/vault/events","assignees_url":"https://api.github.com/repos/hashicorp/vault/assignees{/user}","branches_url":"https://api.github.com/repos/hashicorp/vault/branches{/branch}","tags_url":"https://api.github.com/repos/hashicorp/vault/tags","blobs_url":"https://api.github.com/repos/hashicorp/vault/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/vault/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/vault/git/refs{/sha}","trees_url":"https://api.github.com/repos/hashicorp/vault/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/{sha}","languages_url":"https://api.github.com/repos/hashicorp/vault/languages","stargazers_url":"https://api.github.com/repos/hashicorp/vault/stargazers","contributors_url":"https://api.github.com/repos/hashicorp/vault/contributors","subscribers_url":"https://api.github.com/repos/hashicorp/vault/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/vault/subscription","commits_url":"https://api.github.com/repos/hashicorp/vault/commits{/sha}","git_commits_url":"https://api.github.com/repos/hashicorp/vault/git/commits{/sha}","comments_url":"https://api.github.com/repos/hashicorp/vault/comments{/number}","issue_comment_url":"https://api.github.com/repos/hashicorp/vault/issues/comments{/number}","contents_url":"https://api.github.com/repos/hashicorp/vault/contents/{+path}","compare_url":"https://api.github.com/repos/hashicorp/vault/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hashicorp/vault/merges","archive_url":"https://api.github.com/repos/hashicorp/vault/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hashicorp/vault/downloads","issues_url":"https://api.github.com/repos/hashicorp/vault/issues{/number}","pulls_url":"https://api.github.com/repos/hashicorp/vault/pulls{/number}","milestones_url":"https://api.github.com/repos/hashicorp/vault/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/vault/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hashicorp/vault/labels{/name}","releases_url":"https://api.github.com/repos/hashicorp/vault/releases{/id}","deployments_url":"https://api.github.com/repos/hashicorp/vault/deployments","created_at":"2015-02-25T00:15:59Z","updated_at":"2016-04-19T09:30:54Z","pushed_at":"2016-04-19T18:21:56Z","git_url":"git://github.com/hashicorp/vault.git","ssh_url":"git@github.com:hashicorp/vault.git","clone_url":"https://github.com/hashicorp/vault.git","svn_url":"https://github.com/hashicorp/vault","homepage":"https://www.vaultproject.io/","size":14634,"stargazers_count":4437,"watchers_count":4437,"language":"JavaScript","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":401,"mirror_url":null,"open_issues_count":164,"forks":401,"open_issues":164,"watchers":4437,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/1300"},"html":{"href":"https://github.com/hashicorp/vault/pull/1300"},"issue":{"href":"https://api.github.com/repos/hashicorp/vault/issues/1300"},"comments":{"href":"https://api.github.com/repos/hashicorp/vault/issues/1300/comments"},"review_comments":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/1300/comments"},"review_comment":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/1300/commits"},"statuses":{"href":"https://api.github.com/repos/hashicorp/vault/statuses/1a5deeec0622c23193c042e29969ed4bad5c5392"}}}}