approleID + wrapped secretID vs. wrapped Vault token

Vault
1

Hello,

I would like to securely enable a machine to interact with Vault. I came up with two approaches.

The first approach provisions an approleID and a secretID to the machine in the following way:

  1. Machine starts.
  2. Machine sends HTTP request to approle-provisioner service.
  3. approle-provisioner service validates the requester is allowed to use the requested approle.
  4. approle-provisioner service fetches an approleID from Vault.
  5. approle-provisioner service fetches a response-wrapped secretID.
  6. approle-provisioner transfers approleID and unwrapping token to requester via SCP.
  7. Machine unwraps secretID.
  8. Machine logs into Vault with approleID and secretID and uses the resulting Vault token.

The second approach directly provisions a Vault token to the machine:

  1. Machine starts.
  2. Machine sends HTTP request to token-provisioner service.
  3. token-provisioner service validates the requester is allowed to use the requested approle.
  4. token-provisioner performs the vault login with response wrapping.
  5. token-provisioner transfers wrapping token to requester via SCP.
  6. Machine unwraps token and uses the resulting Vault token.

The first approach allows me to constrain the secretID usage (e. g. TTL and number of uses) separately from the token constraints. The second approach appears simpler, but once the token expires, the token-provisioner must be triggered again to fetch a new token.

Do you see any other advantages and disadvantages?

Best
Nick