vault_plugin_secrets_backblazeb2

Vault Plugin: Backblaze B2 Secrets Backend

This is a HashiCorp Vault plugin that generates application keys for Backblaze B2 Cloud Storage.

Download

Binary releases are available at https://github.com/Boostport/vault-plugin-secrets-backblazeb2/releases.

Verify Binaries

The checksum for the binaries are signed with cosign. To verify the binaries, download the following files (where ${VERSION} is the version of the release):

• vault-plugin-secrets-backblazeb2_${VERSION}_checksums.txt
• vault-plugin-secrets-backblazeb2_${VERSION}_checksums.txt.pem
• vault-plugin-secrets-backblazeb2_${VERSION}_checksums.txt.sig

Then download the release binaries you need. Here, we just download the linux amd64 binary:

• vault-plugin-secrets-backblazeb2_${VERSION}_linux_amd64

Then run the following commands to verify the checksums and signature:

# Verify checksum signature
$ cosign verify-blob --signature vault-plugin-secrets-backblazeb2_${VERSION}_checksums.txt.sig --certificate vault-plugin-secrets-backblazeb2_${VERSION}_checksums.txt.pem vault-plugin-secrets-backblazeb2_${VERSION}_checksums.txt --certificate-identity "https://github.com/Boostport/vault-plugin-secrets-backblazeb2/.github/workflows/release.yml@refs/tags/v${VERSION}" --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

# Verify checksum with binaries
$ sha256sum -c vault-plugin-secrets-backblazeb2_${VERSION}_checksums.txt

Usage

1. Once the plugin is registered with your vault instance, you can enable it on a particular path:

$ vault secrets enable -path=backblazeb2 vault-plugin-secrets-backblazeb2

1. Configure the backend with your Backblaze B2 application key id and application key:

$ vault write backblazeb2/config application_key_id=<account id> application_key=<key id>

1. Create a role:

$ vault write backblazeb2/roles/example capabilities=listBuckets,listFiles,readFiles

1. Issue credentials:

$ vault read backblazeb2/creds/example

Backend Configuration

Role Configuration