-
Notifications
You must be signed in to change notification settings - Fork 23
/
Copy pathvault.tf
113 lines (86 loc) · 4.78 KB
/
vault.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
# ---------------------------------------------------------------------------------------------------------------------
# DEPLOY THE VAULT SERVER CLUSTER
# ---------------------------------------------------------------------------------------------------------------------
locals {
vault_api_port = 8200
vault_user_data = coalesce(var.vault_user_data, data.template_file.user_data_vault_cluster.rendered)
# Port for connection between the ELB and Vault
vault_lb_port = 8300
auto_unseal_region = coalesce(var.vault_auto_usneal_kms_key_region, data.aws_region.current.name)
auto_unseal_flags = <<EOF
--enable-auto-unseal \
--auto-unseal-kms-key-id ${jsonencode(var.vault_auto_unseal_kms_key_arn)} \
--auto-unseal-kms-key-region ${jsonencode(local.auto_unseal_region)} \
--auto-unseal-endpoint ${jsonencode(var.vault_auto_unseal_kms_endpoint)}
EOF
}
module "vault" {
# copy of https://github.com/hashicorp/terraform-aws-vault/tree/v0.14.1/modules/vault-cluster
source = "../vault-cluster"
cluster_name = var.vault_cluster_name
cluster_size = var.vault_cluster_size
instance_type = var.vault_instance_type
ami_id = var.vault_ami_id
user_data = local.vault_user_data
root_volume_type = var.vault_root_volume_type
root_volume_size = var.vault_root_volume_size
vpc_id = var.vpc_id
subnet_ids = var.vault_subnets
api_port = local.vault_api_port
ssh_key_name = var.ssh_key_name
allowed_inbound_security_group_count = var.vault_allowed_inbound_security_group_count
allowed_inbound_security_group_ids = var.vault_allowed_inbound_security_group_ids
allowed_inbound_cidr_blocks = var.vault_allowed_inbound_cidr_blocks
allowed_ssh_cidr_blocks = concat([data.aws_vpc.this.cidr_block], var.allowed_ssh_cidr_blocks)
associate_public_ip_address = var.associate_public_ip_address
enable_s3_backend = var.vault_enable_s3_backend
s3_bucket_name = var.vault_s3_bucket_name
enable_auto_unseal = var.vault_enable_auto_unseal
auto_unseal_kms_key_arn = var.vault_auto_unseal_kms_key_arn
termination_policies = var.vault_termination_policies
iam_permissions_boundary = var.iam_permissions_boundary
}
# ---------------------------------------------------------------------------------------------------------------------
# ATTACH IAM POLICIES FOR CONSUL
# To allow our Vault servers to automatically discover the Consul servers, we need to give them the IAM permissions from
# the Consul AWS Module's consul-iam-policies module.
# ---------------------------------------------------------------------------------------------------------------------
module "vault_iam_policies_servers" {
source = "github.com/hashicorp/terraform-aws-consul.git//modules/consul-iam-policies?ref=v0.8.3"
iam_role_id = module.vault.iam_role_id
}
# ---------------------------------------------------------------------------------------------------------------------
# THE USER DATA SCRIPT THAT WILL RUN ON EACH VAULT SERVER WHEN IT'S BOOTING
# This script will configure and start Vault
# ---------------------------------------------------------------------------------------------------------------------
data "template_file" "user_data_vault_cluster" {
template = file("${path.module}/user_data/user-data-vault.sh")
vars = {
aws_region = data.aws_region.current.name
consul_cluster_tag_key = var.cluster_tag_key
consul_cluster_tag_value = var.consul_cluster_name
# These paths are set by default by the Packer template. If you have modified them, you
# will need to change this.
cert_file = "/opt/vault/tls/vault.crt"
cert_key = "/opt/vault/tls/vault.key"
cert_key_encrypted = "/opt/vault/tls/vault.encrypted.key"
aes_key = "/opt/aes-kms/keys/aes.encrypted.key"
cli_json = "/opt/aes-kms/keys/cli.json"
kms_aes_root = "/opt/aes-kms"
# S3 Variables
enable_s3_backend = var.vault_enable_s3_backend ? "true" : "false"
s3_bucket_name = var.vault_s3_bucket_name
consul_prefix = var.integration_consul_prefix
lb_listener_port = local.vault_lb_port
lb_cidr = join(",", data.aws_subnet.internal_lb_subnets.*.cidr_block)
auto_unseal = var.vault_enable_auto_unseal ? local.auto_unseal_flags : ""
}
}
# ---------------------------------------------------------------------------------------------------------------------
# IAM Policy to allow the instances to decrypt the encrypted TLS key baked into the AMI via the Packer template
# Refer to README for more information
# ---------------------------------------------------------------------------------------------------------------------
resource "aws_iam_role_policy_attachment" "vault_decrypt" {
role = module.vault.iam_role_id
policy_arn = var.vault_tls_key_policy_arn
}