pentest api-security vault aws ssm okta appsec
Vault API — Kickoff Questions
Unresolved architecture, scope, and access questions. Move items to Vault API - Architecture under Confirmed once validated.
Identity & Authorization
To Confirm
- How does Okta identity map to Team ID?
- Is Team ID client-controlled or server-derived?
- What role types exist in the permission model?
- What SSO groups are relevant to Vault access?
- Are separate test users available for separate teams?
- How many Team IDs are available for testing?
- Can one identity belong to multiple teams?
API & Endpoints
To Confirm
- Exact API endpoints (base URL, version, paths)
- Is OpenAPI / Swagger available?
- What secret lifecycle operations are supported? (read / create / update / delete / rotation)
- Are there admin / management endpoints?
- What rate limits exist?
AWS & Backend
To Confirm
- What AWS IAM role / identity does Vault use to access SSM?
- What SSM paths / resources can the backend role access?
- What is the SSM naming / path convention? (e.g.,
/team-a/,/app/env/) - How are teams separated at the SSM layer?
- Is this Vault API the same service as the “Internal Vault” in the
Vault → SSM → External Secrets Operatorpath documented for GForge? → GForge - Architecture > Supporting Secret and Configuration Path - Do consuming applications read secrets via the Vault API at runtime, or only indirectly from SSM after injection?
Environments & Scope
To Confirm
- What are Test vs Staging vs Production differences? (endpoints, data, permissions)
- What production validation is permitted?
- Are mock secrets available for testing?
- What is explicitly out of scope?
Logging & Audit
To Confirm
- Where are security / audit logs available?
- Are failed authorization attempts logged and alerted?
- What identity / team / resource metadata appears in logs?
Governance & Known Issues
To Confirm
- Any known exceptions or accepted risks?
- Existing Snyk findings to avoid duplicating? (see GEL - Integrations > Snyk)
- Emergency contacts for the engagement