RabbitMQ Dynamic Secrets

You can define a dynamic RabbitMQ secret to generate user credentials dynamically based on configured permissions.

When a client requests a dynamic secret value, the Akeyless vault platform connects to the target RabbitMQ server through the Gateway and creates a new user.

Prerequisites

Before creating a dynamic RabbitMQ secret, ensure that the RabbitMQ user has sufficient privileges to create other users.

Create a Dynamic RabbitMQ Secret from the CLI

👍

Tip

To set up a dynamic secret, you can either configure a connection to the target server first or provide all parameters of the target server in the secret creation command.

We recommend using dynamic secrets together with targets. It allows saving time on the secrets' configuration. To enable this flow, you must ensure that the user responsible for creating dynamic secrets has permission to access or create targets.

To create a dynamic RabbitMQ secret from the CLI using the existing target, run the following command:

akeyless gateway-create-producer-rabbitmq \
--name <Dynamic Secret Name> \
--target-name <Target Name> \
--gateway-url 'https:\\<Your-Akeyless-GW-URL:8000>' \
--rabbitmq-user-conf-permission <User configuration permission> \
--rabbitmq-user-write-permission <User write permission> \
--rabbitmq-user-read-permission <User read permission>

Where:

  • name: A unique name of the dynamic secret. The name can include the path to the virtual folder where you want to create the new dynamic secret, using slash / separators. If the folder does not exist, it will be created together with the dynamic secret.

  • target-name: A name of the target that enables connection to the RabbitMQ server. The name can include the path to the virtual folder where this target resides.

  • gateway-url: API Gateway URL.

  • rabbitmq-user-conf-permission: User configuration permissions, for example: .*,queue-name.

  • rabbitmq-user-write-permission: User write permissions, for example: .*,queue-name.

  • rabbitmq-user-read-permission: User read permissions, for example: .*,queue-name.

If you don't have a configured RabbitMQ target yet, you can use the command with your RabbitMQ target server connection parameters:

akeyless gateway-create-producer-rabbitmq \
--name <Dynamic Secret Name> \
--target-name <Target Name> \
--gateway-url 'https:\\<Your-Akeyless-GW-URL:8000>' \
--rabbitmq-user-conf-permission <User configuration permission> \
--rabbitmq-user-write-permission <User write permission> \
--rabbitmq-user-read-permission <User read permission> \
--rabbitmq-server-uri <RabbitMQ server URI> \
--rabbitmq-admin-user <RabbitMQ server admin> \
--rabbitmq-admin-pwd <RabbitMQ server password>

Where:

  • rabbitmq-server-uri: URI of the RabbitMQ server.

  • rabbitmq-admin-user: Admin username for the RabbitMQ server.

  • rabbitmq-admin-pwd: Admin password for the RabbitMQ server.

You can find the complete list of parameters for this command in the CLI Reference - Akeyless Producers section.

Fetch a Dynamic RabbitMQ Secret value from the CLI

To fetch a dynamic RabbitMQ secret value from the CLI, run the following command:

akeyless get-dynamic-secret-value --name <Path to your dynamic secret>

Create a Dynamic RabbitMQ Secret in the Akeyless Console

👍

Tip

To start working with dynamic secrets from the Akeyless Console, you need to configure the Gateway URL thus enabling communication between the Akeyless SaaS and the Akeyless Gateway.

To create dynamic secrets directly from the Akeyless Gateway, you can use the Gateway Configuration Manager.

  1. Log in to the Akeyless Console, and go to Secrets & Keys > New > Dynamic Secret.

  2. Select the RabbitMQ secret type and click Next.

  3. Define a Name of the dynamic secret, and specify the Location as a path to the virtual folder where you want to create the new dynamic secret, using slash / separators. If the folder does not exist, it will be created together with the dynamic secret.

  4. Define the remaining parameters as follows:

  • Delete Protection: When enabled, protects the secret from accidental deletion.

  • Target mode: In this section, you can either select an existing RabbitMQ Target or specify details of the target RabbitMQ server explicitly (e.g., if you are not authorized to create and access Targets in the Akeyless Console).

    • Use the Choose an existing target drop-down list to select the existing RabbitMQ Target.

    • Check the Explicitly specify target properties radio button to provide details of the target RabbitMQ server on the next step of the wizard.

👍

Tip

We recommend using dynamic secrets together with targets. It allows saving time on the secrets' configuration. To enable this flow, you must ensure that the user responsible for creating dynamic secrets has permission to access or create targets.

RabbitMQ distinguishes between configure, write, and read operations on a resource. To perform an operation on a resource, the user must be granted the appropriate permissions for it. The RabbitMQ permissions reference outlines the relevant resources and operations.

  • User Configuration Permission: Enter the resources for which the configure operation can be performed when accessed using the relevant dynamic key.

  • User Write Permission: Enter the resources for which the write operation can be performed when accessed using the relevant dynamic key.

  • User Read Permission: Enter the resources for which the read operation can be performed when accessed using the relevant dynamic key.

  • User Virtual Host: In RabbitMQ, user permissions are granted per virtual host. Bind the user to the specific virtual host (default “/”).

  • User Tags: Access to management UI in RabbitMQ can be controlled with user tags. Insert relevant user tags in a comma-separated list, including these tags: management, administrator, monitoring, policymaker.

  • User TTL: Provide a time-to-live value for a dynamic secret (i.e., a key). When TTL expires, the key becomes obsolete.

  • Time Unit: Select the time unit (seconds, minutes, hours) for the TTL value.

  • Gateway: Select the Gateway through which the dynamic secret will create users.

  • Protection key: To enable zero-Knowledge, select a key with a Customer Fragment. For more information about zero-Knowledge, see Implement Zero Knowledge

  1. If you checked the Explicitly specify target properties radio button, click Next.

  2. Provide details of the target RabbitMQ server:

  • Server URI: Enter the RabbitMQ server address.

  • Admin User: Enter your RabbitMQ admin credentials.

  • Admin Password: Enter your RabbitMQ admin credentials.

  1. Click Finish.

Fetch a Dynamic RabbitMQ Secret Value from the Akeyless Console

  1. Log in to the Akeyless Console, and go to Secrets & Keys.

  2. Browse to the folder where you created a dynamic secret.

  3. Select the secret and click Get Dynamic Secret button.


Did this page help you?