Secret name: HashiCorp Cloud Platform (HCP) API keys

Risk in exposing the secret: HCP is a managed platform offering HashiCorp products-as-a-service. With exposed HCP API keys attackers can gain access to sensitive cloud resources, manage Vault secrets, provision infrastructure, escalate privileges, and potentially access or manipulate production data and billing information. Furthermore the secrets can be leveraged to access other services, such as cloud environments (GCP, Azure, and so on).

Validation method, if any:

• An access token can be created by calling the oauth2 token endpoint with HCP_CLIENT_ID and HCP_CLIENT_SECRET.
• With the HCP_ACCESS_TOKEN query the HCP API endpoints (such as the /v1/organizations and /v1/projects endpoints) to check if the exposed API key is able to access valid organization or project data. See additional details on IAM policy here.

Resources:

• https://www.hashicorp.com/en/cloud
• https://developer.hashicorp.com/hcp
• https://developer.hashicorp.com/hcp/docs/hcp
• https://developer.hashicorp.com/hcp/docs/hcp/api