Skip to content
This repository was archived by the owner on Jul 16, 2024. It is now read-only.

Commit 05e3fcb

Browse files
tfhartmanntfhartmann
authored
README updates, and update to unseal_keys (#1)
unseal_key has now become unseal_keys, and accepts a list as its parameters. The list should have three elements, each an unseal key, which is used to unseal the vault docker container.
1 parent ecd557c commit 05e3fcb

File tree

5 files changed

+82
-79
lines changed

5 files changed

+82
-79
lines changed

‎README.md

Lines changed: 22 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Terraform Module for deploying Vault on AWS ECS
66

77
This module contains a `.terraform-version` file which matches the version of Terraform we currently use to test with.
88

9-
> CircleCI
9+
[![CircleCI](https://circleci.com/gh/FitnessKeeper/terraform-aws-vault.svg?style=svg)](https://circleci.com/gh/FitnessKeeper/terraform-aws-vault)
1010

1111

1212
#### Introduction and Assumptions
@@ -41,7 +41,7 @@ Create a Master Key AWS docs can be found here: http://docs.aws.amazon.com/kms/l
4141

4242
Use the newly created master key to encrypt the vault unseal key.
4343

44-
`aws kms encrypt --key-id $KEY_ID --plaintext 'secret' --encryption-context region=us-east-1 --encryption-context tier=dev --output text --query CiphertextBlob`
44+
`aws kms encrypt --key-id $KEY_ID --plaintext 'secret' --encryption-context region=us-east-1,tier=dev --output text --query CiphertextBlob`
4545

4646

4747
Module Input Variables
@@ -52,94 +52,42 @@ Module Input Variables
5252
- `ecs_cluster_id` - ARN of the ECS ID
5353
- `env` - env to deploy into, should typically dev/staging/prod
5454
- `subnets` - List of subnets used to deploy the Consul alb
55+
- `unseal_keys` - List of 3 Vault Unseal keys
5556
- `vpc_id` - VPC ID
5657

57-
5858
#### Optional
5959

60-
- `additional_user_data_script` - Additional user_data scripts content
61-
- `region` - AWS Region - defaults to us-east-1
62-
- `extra_tags` - Additional tags to be added to the ECS autoscaling group. Must be in the form of an array of hashes. See https://www.terraform.io/docs/providers/aws/r/autoscaling_group.html for examples.
63-
```
64-
extra_tags = [
65-
{
66-
key = "consul_server"
67-
value = "true"
68-
propagate_at_launch = true
69-
},
70-
]
71-
```
72-
- `allowed_cidr_blocks` - List of subnets to allow into the ECS Security Group. Defaults to `["0.0.0.0/0"]`.
73-
- `heartbeat_timeout` - Heartbeat Timeout setting for how long it takes for the graceful shutodwn hook takes to timeout. This is useful when deploying clustered applications like consul that benifit from having a deploy between autoscaling create/destroy actions. Defaults to 180"
74-
- `security_group_ids` - a list of security group IDs to apply to the launch configuration
75-
- `vault_image` - Image to use when deploying consul, defaults to the hashicorp consul image
60+
- `vault_image` - Image to use when deploying vault, defaults to the hashicorp vault image
61+
- `desired_count` - Number of vaults that ECS should run. Defaults to 2
62+
- `hostname` - DNS Hostname for the bastion host. Defaults to ${VPC NAME}.${dns_zone} if hostname is not set
63+
- `iam_path` - IAM path, this is useful when creating resources with the same name across multiple regions. Defaults to /
64+
- `region` - AWS Region, defaults to us-east-1
7665

7766
Usage
7867
-----
7968

8069
```hcl
81-
module "ecs-cluster" {
82-
source = "github.com/terraform-community-modules/tf_aws_ecs"
83-
name = "infra-services"
84-
servers = 1
85-
subnet_id = ["subnet-6e101446"]
86-
vpc_id = "vpc-99e73dfc"
70+
module "vault" {
71+
source = "../modules/terraform-vault"
72+
#source = "github.com/FitnessKeeper/terraform-aws-vault?ref=v0.0.1"
73+
alb_log_bucket = "rk-devops-${var.region}"
74+
vault_image = "${var.vault_image}"
75+
ecs_cluster_id = "${module.ecs_consul.cluster_id}"
76+
dns_zone = "${aws_route53_zone.region.name}"
77+
env = "${var.env}"
78+
subnets = "${module.vpc.public_subnets}"
79+
#unseal_key = "${data.aws_kms_secret.unseal_key.vault}" # pass in a list "${split(",",data.aws_kms_secret.unseal_key.vault)}"
80+
unseal_keys = "${split(",",data.aws_kms_secret.unseal_key2.vault)}"
81+
vpc_id = "${module.vpc.vpc_id}"
8782
}
8883
8984
```
9085

91-
#### Example cluster with consul and Registrator
92-
93-
In order to start the Consul/Registrator task in ECS, you'll need to pass in a consul config into the `additional_user_data_script` script parameter. For example, you might pass something like this:
94-
95-
Please note, this module will try to mount `/etc/consul/` into `/consul/config` in the container and assumes that the consul config lives under `/etc/consul` on the docker host.
96-
97-
```Shell
98-
/bin/mkdir -p /etc/consul
99-
cat <<"CONSUL" > /etc/consul/config.json
100-
{
101-
"raft_protocol": 3,
102-
"log_level": "INFO",
103-
"enable_script_checks": true,
104-
"datacenter": "${datacenter}",
105-
"retry_join_ec2": {
106-
"tag_key": "consul_server",
107-
"tag_value": "true"
108-
}
109-
}
110-
CONSUL
111-
```
112-
113-
114-
```hcl
115-
116-
data "template_file" "ecs_consul_agent_json" {
117-
template = "${file("ecs_consul_agent.json.sh")}"
118-
119-
vars {
120-
datacenter = "infra-services"
121-
}
122-
}
123-
124-
module "ecs-cluster" {
125-
source = "github.com/terraform-community-modules/tf_aws_ecs"
126-
name = "infra-services"
127-
servers = 1
128-
subnet_id = ["subnet-6e101446"]
129-
vpc_id = "vpc-99e73dfc"
130-
additional_user_data_script = "${data.template_file.ecs_consul_agent_json.rendered}"
131-
enable_agents = true
132-
}
133-
134-
135-
```
136-
137-
13886
Outputs
13987
=======
14088

141-
- `cluster_id` - _(String)_ ECS Cluster id for use in ECS task and service definitions.
142-
- `autoscaling_group` _(Map)_ A map with keys `id`, `name`, and `arn` of the `aws_autoscaling_group` created.
89+
- `public_endpoint` - _(String)_ Public FQDN of the ALB. i.e. vault.example.com
90+
- `public_url` - _(String)_ Public URL used to connect to vault. i.e. https://vault.example.com
14391

14492
Authors
14593
=======

‎files/vault.json

Lines changed: 50 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828
}
2929
},
3030
{
31-
"name": "vault-unseal-${env}",
31+
"name": "vault-unseal-${env}-0",
3232
"image": "${image}",
3333
"memoryReservation": 10,
3434
"privileged": true,
@@ -40,7 +40,55 @@
4040
}
4141
],
4242
"command": [
43-
"sh", "-c", "sleep 10; vault unseal ${unseal_key} "
43+
"sh", "-c", "sleep 10; vault unseal ${unseal_key0} "
44+
],
45+
"logConfiguration": {
46+
"logDriver": "awslogs",
47+
"options": {
48+
"awslogs-group": "${awslogs_group}",
49+
"awslogs-region": "${awslogs_region}",
50+
"awslogs-stream-prefix": "${awslogs_stream_prefix}"
51+
}
52+
}
53+
},
54+
{
55+
"name": "vault-unseal-${env}-1",
56+
"image": "${image}",
57+
"memoryReservation": 10,
58+
"privileged": true,
59+
"essential": false,
60+
"environment": [
61+
{
62+
"name": "VAULT_ADDR",
63+
"value": "http://127.0.0.1:8200"
64+
}
65+
],
66+
"command": [
67+
"sh", "-c", "sleep 10; vault unseal ${unseal_key1} "
68+
],
69+
"logConfiguration": {
70+
"logDriver": "awslogs",
71+
"options": {
72+
"awslogs-group": "${awslogs_group}",
73+
"awslogs-region": "${awslogs_region}",
74+
"awslogs-stream-prefix": "${awslogs_stream_prefix}"
75+
}
76+
}
77+
},
78+
{
79+
"name": "vault-unseal-${env}-2",
80+
"image": "${image}",
81+
"memoryReservation": 10,
82+
"privileged": true,
83+
"essential": false,
84+
"environment": [
85+
{
86+
"name": "VAULT_ADDR",
87+
"value": "http://127.0.0.1:8200"
88+
}
89+
],
90+
"command": [
91+
"sh", "-c", "sleep 10; vault unseal ${unseal_key2} "
4492
],
4593
"logConfiguration": {
4694
"logDriver": "awslogs",

‎main.tf

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,9 @@ data "template_file" "vault" {
2020
datacenter = "${data.aws_vpc.vpc.tags["Name"]}"
2121
env = "${var.env}"
2222
image = "${var.vault_image}"
23-
unseal_key = "${var.unseal_key}"
23+
unseal_key0 = "${var.unseal_keys[0]}"
24+
unseal_key1 = "${var.unseal_keys[1]}"
25+
unseal_key2 = "${var.unseal_keys[2]}"
2426
awslogs_group = "vault-${var.env}"
2527
awslogs_stream_prefix = "vault-${var.env}"
2628
awslogs_region = "${var.region}"

‎outputs.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
11
output "public_endpoint" {
22
value = "${aws_route53_record.vault.fqdn}"
33
}
4+
5+
output "public_url" {
6+
value = "https://${aws_route53_record.vault.fqdn}"
7+
}

‎variables.tf

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,9 @@ variable "region" {
4242
description = "AWS Region, defaults to us-east-1"
4343
}
4444

45-
variable "unseal_key" {
46-
description = "Vault Unseal key"
45+
variable "unseal_keys" {
46+
type = "list"
47+
description = "List of 3 Vault Unseal keys"
4748
}
4849

4950
variable "vpc_id" {}

0 commit comments

Comments
 (0)