pentest api-security vault aws ssm okta idor bola appsec
Vault API — Overview
What Vault Is
Vault API is an internal secrets-management API. It provides an abstraction and security layer in front of AWS SSM Parameter Store, handling authentication, authorization, and API semantics before backend parameter access.
What Problem It Solves
- Centralizes secret storage and retrieval for internal applications
- Enforces identity and team-scoped access before secrets reach callers
- Abstracts SSM path and parameter management behind a controlled API
Main Components
| Component | Role |
|---|---|
| VPN / Genesys VPC | Network boundary — trusted clients only |
| Okta | Identity provider / SSO |
| Bearer token | Session credential from Okta |
| Team ID | Authorization scope |
| Vault API | AuthN/AuthZ enforcement, secret lifecycle operations |
| AWS SSM Parameter Store | Backend key/value secret storage |
| AWS IAM (backend role) | Permissions Vault uses when calling SSM |
Primary Security Concern
Important
The central security question is whether an authenticated identity can perform only the authorized operations against only the secrets/resources belonging to its permitted team.
Authentication (who are you?) and authorization (what may you access?) are distinct. The pentest focus is authorization boundaries — especially cross-team access (IDOR / BOLA).
Mental Model
flowchart LR A[User / Application] --> B[VPN / Genesys VPC] B --> C[Okta] C --> D[Bearer Token] D --> E[Team ID / Authorization] E --> F[Vault API] F --> G[AWS SSM Parameter Store]
| Concept | Question |
|---|---|
| Authentication | Who are you? (Okta identity → bearer token) |
| Authorization | What are you allowed to access? (Team ID → resource scope) |
Key Terminology
- Team ID — scope identifier tying an identity to a set of secrets/resources
- SSO group — Okta group membership that may influence access
- BOLA / IDOR — accessing objects (secrets, resources) outside permitted scope
- Backend role — AWS IAM identity Vault uses to read/write SSM parameters
Relationship to GEL
Vault is a specific service being assessed. GEL is the broader application governance / security platform that may eventually consume Vault pentest status as part of security gating.
See GEL - Overview and GEL - Security Model.