• Verify the VM service account configuration

  To verify your service account configuration:

  • Check the service account attached to the VM:
    1. Sign in to the GCP console.
    2. In the top-left corner of the console, select Navigation menu (.).
    3. From the left-side navigation, select Compute Engine > VM instances.
    4. On the VM instances page, select your VM instance.
    5. On the Details tab, under API and identity management, verify that the correct Service account is displayed.
  • Verify the service account permissions:
    1. Sign in to the GCP console.
    2. In the top-left corner of the console, select Navigation menu (.).
    3. From the left-side navigation, select IAM & Admin > Service Accounts
    4. On the Service accounts page, select your service account.
    5. On the service account page, select the Permissions tab.
    6. On the Permissions tab, ensure that the Service Account Token Creator role is correctly assigned.
  • Confirm the service account in the HashiCorp Vault's bound_service_accounts by contacting your Vault administrator to verify that the service account email is listed in the bound_service_accounts for the IAM authentication role.

  Close
• Verify the VM configuration

  To verify your VM configuration, check your VM metadata:

  1. Sign in to the GCP console.
  2. In the top-left corner of the console, select Navigation menu (.).
  3. From the left-side navigation, select Compute Engine > VM instances.
  4. On the VM instances page, select your VM instance.
  5. On the Details tab, locate the Custom metadata section.

  6. Verify that the metadata keys for Vault Address, Secret Path, and IAM Auth Role are correctly set per your Vault configuration.

     ZSCALER
      hcp_vault_addr: "https://vault-cluster-public-vault-example.z1.hashicorp.cloud:8200"
      hcp_vault_secret_path: "admin/secret/data/example-zscaler-secret"
      hcp_vault_role_name: "example-iam-auth-role"

  Close
• Verify the Vault configuration

  To verify your Vault configuration:

  • Confirm your Vault address and accessibility:
    • Ensure that the Vault address, protocol, and port number (i.e., 8200) are correct.
    • Ensure that the Vault UI or API is reachable from your machine by testing the accessibility.
  • Verify your GCP IAM authentication role in the Vault by confirming the following with your administrator:
    • The GCP IAM authentication role exists and is named correctly.
    • The type is set to iam.
    • The appropriate policies are attached.
    • The max_jwt_exp is set to "60m".
    • The bound_service_accounts include your VM service account.
  • Verify your Vault GCP auth credentials:
    • Configure the GCP auth method to use the VaultServiceAccountKey.json credentials. Ensure that you successfully created a service account with the Service Account Key Admin permissions and that the service account credentials are exported and used for auth/gcp/config (i.e., VaultServiceAccountKey.json).

    • HashiCorp CLI:

      vault write auth/gcp/config \

      credentials=@VaultServiceAccountKey.json

  Close
• Verify your VM network connectivity

  To test your network connectivity:

  1. Verify that your network tags and firewall rules are correctly set:
     1. Sign in to the GCP console.
     2. In the top-left corner of the console, select Navigation menu (.).
     3. From the left-side navigation, select Compute Engine > VM instances.
     4. On the VM instances page, select your VM instance.
     5. On the Details tab, in the Network tags section, note the tags assigned to your VM.
     6. In the top-left corner of the console, select Navigation menu (.).
     7. From the left-side navigation, select VPC Network > Firewall.
     8. On the Firewall policies page, ensure that your outbound traffic to the Vault address on port 8200 is permitted.
  2. Secure Socket Shell (SSH) into your VM instance.

  3. Replace <vault-address> with your Vault's address. Omit https:// or http://.

     sudo bash
     nc -zv vault-cluster-public-vault-abc.xyz.z1.hashicorp.cloud 8200
     Connection to vault-cluster-public-vault-abc.xyz.z1.hashicorp.cloud 8200 port [tcp/*] succeeded!

  4. Test the connection using curl.

     curl -v <vault-address>:8200/v1/sys/health
     A JSON response indicating Vault's health should be returned.

  Close

The following table displays common issues and resolutions: