DevOps
/
HC-vault-on-aws-FORK
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

support any number of peered VPCs

This commit is contained in:
J Cole Morrison 2020-04-15 13:45:57 -07:00
parent 8fa66281fc
commit 09323580c8
5 changed files with 30 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored
View File

@ -5,4 +5,5 @@ terraform.tfvars
todos.md todos.md
.DS_Store .DS_Store
files/user_data_compiled.sh files/user_data_compiled.sh
tmp/ tmp/
temp/

4
files/vault_credentials_template.sh
View File

@ -2,5 +2,5 @@
# This grabs the encrypted credentials file and decrypts it. # This grabs the encrypted credentials file and decrypts it.
aws --profile ${AWS_PROFILE} --region ${AWS_REGION} s3 cp s3://${AWS_S3_BUCKET}/vault_creds_encrypted ./tmp/vault_creds_encrypted aws --profile ${AWS_PROFILE} --region ${AWS_REGION} s3 cp s3://${AWS_S3_BUCKET}/vault_creds_encrypted ./temp/vault_creds_encrypted
aws --profile ${AWS_PROFILE} --region ${AWS_REGION} kms decrypt --key-id ${AWS_KMS_KEY_ID} --ciphertext-blob fileb://tmp/vault_creds_encrypted --output text --query Plaintext | base64 --decode > ./tmp/vault_creds_decrypted aws --profile ${AWS_PROFILE} --region ${AWS_REGION} kms decrypt --key-id ${AWS_KMS_KEY_ID} --ciphertext-blob fileb://temp/vault_creds_encrypted --output text --query Plaintext | base64 --decode > ./temp/vault_creds_decrypted

8
outputs.tf
View File

@ -1,6 +1,6 @@
# Here for debugging the compiled userdata.sh file. # Here for debugging the compiled userdata.sh file.
resource "local_file" "userdata_compiled" { resource "local_file" "userdata_compiled" {
content = templatefile("${path.module}/files/userdata_template.sh", { content = templatefile("${path.root}/files/userdata_template.sh", {
VAULT_VERSION = var.vault_version VAULT_VERSION = var.vault_version
VAULT_CLUSTER_NAME = var.main_project_tag VAULT_CLUSTER_NAME = var.main_project_tag
VAULT_DNS = var.domain_name VAULT_DNS = var.domain_name
@ -9,18 +9,18 @@ resource "local_file" "userdata_compiled" {
VAULT_DYNAMODB_TABLE = var.dynamodb_table_name # dynamodb resource doesn't return name.... VAULT_DYNAMODB_TABLE = var.dynamodb_table_name # dynamodb resource doesn't return name....
VAULT_S3_BUCKET_NAME = aws_s3_bucket.vault_data.id VAULT_S3_BUCKET_NAME = aws_s3_bucket.vault_data.id
}) })
filename = "${path.module}/tmp/userdata_compiled.sh" filename = "${path.root}/temp/userdata_compiled.sh"
} }
# Output the vault credentials script # Output the vault credentials script
resource "local_file" "vault_credentials" { resource "local_file" "vault_credentials" {
content = templatefile("${path.module}/files/vault_credentials_template.sh", { content = templatefile("${path.root}/files/vault_credentials_template.sh", {
AWS_PROFILE = var.aws_profile AWS_PROFILE = var.aws_profile
AWS_REGION = data.aws_region.current.name AWS_REGION = data.aws_region.current.name
AWS_S3_BUCKET = aws_s3_bucket.vault_data.id AWS_S3_BUCKET = aws_s3_bucket.vault_data.id
AWS_KMS_KEY_ID = aws_kms_key.seal.key_id AWS_KMS_KEY_ID = aws_kms_key.seal.key_id
}) })
filename = "${path.module}/tmp/vault_credentials.sh" filename = "${path.root}/temp/vault_credentials.sh"
} }
# Load Balancer DNS - You need to CNAME or Alias this. # Load Balancer DNS - You need to CNAME or Alias this.

10
variables.tf
View File

@ -174,9 +174,9 @@ variable "private_mode" {
default = false default = false
} }
## A VPC in the SAME AWS Account AND Region as your Vault deployment. It MUST have "enable dns hostnames" active AND it cannot use the same CIDR block as the Vault VPC. ## A VPC in the SAME AWS Account and REGION as your Vault deployment. The VPCs MUST have "enable dns hostnames" active AND cannot use the same CIDR block as the Vault VPC.
variable "peered_vpc_id" { variable "peered_vpc_ids" {
description = "ID of a VPC that can access the Vault VPC and thus access vault privately." description = "A list of of a VPC IDs that can access the Vault VPC and thus access vault privately."
type = string type = list(string)
default = "" default = []
} }

33
vpc.tf
View File

@ -265,20 +265,20 @@ resource "aws_vpc_endpoint" "dynamodb" {
# VPC Peering # VPC Peering
## Enabled in Private Mode only. ## Enabled in Private Mode only. Allows other VPCs in the same account and region to access your Vault VPC.
## Data from Peered VPC (AKA the external VPC we're letting in) ## Data from Peered VPC (AKA the external VPC we're letting in)
data "aws_vpc" "peered_vpc" { data "aws_vpc" "peered_vpc" {
count = var.private_mode ? 1 : 0 count = var.private_mode && length(var.peered_vpc_ids) > 0 ? length(var.peered_vpc_ids) : 0
id = var.peered_vpc_id id = var.peered_vpc_ids[count.index]
} }
## Peering Connection ## Peering Connections
resource "aws_vpc_peering_connection" "vault" { resource "aws_vpc_peering_connection" "vault" {
count = var.private_mode ? 1 : 0 count = var.private_mode && length(var.peered_vpc_ids) > 0 ? length(var.peered_vpc_ids) : 0
peer_vpc_id = var.peered_vpc_id peer_vpc_id = var.peered_vpc_ids[count.index]
vpc_id = aws_vpc.vault.id vpc_id = aws_vpc.vault.id
auto_accept = true auto_accept = true
@ -291,27 +291,28 @@ resource "aws_vpc_peering_connection" "vault" {
} }
tags = merge( tags = merge(
{ "Name" = "${var.main_project_tag}-vpc-peering-connection"}, { "Name" = "${var.main_project_tag}-vpc-peering-connection-${count.index + 1}"},
{ "Project" = var.main_project_tag }, { "Project" = var.main_project_tag },
var.vpc_tags var.vpc_tags
) )
} }
## Peering Connection for the VAULT Route Table ## Peering Connection Routes for the VAULT Route Table
resource "aws_route" "requester_peering_route" { resource "aws_route" "requester_peering_route" {
count = var.private_mode ? 1 : 0 count = var.private_mode && length(var.peered_vpc_ids) > 0 ? length(var.peered_vpc_ids) : 0
route_table_id = aws_route_table.public.id route_table_id = aws_route_table.public.id
destination_cidr_block = data.aws_vpc.peered_vpc[0].cidr_block destination_cidr_block = data.aws_vpc.peered_vpc[count.index].cidr_block
vpc_peering_connection_id = aws_vpc_peering_connection.vault[0].id vpc_peering_connection_id = aws_vpc_peering_connection.vault[count.index].id
} }
## Peering Connection for the External VPC Route Table to allow Vault Traffic ## Peering Connection Routes for the External VPC Route Tables to allow Vault Traffic
## Note: this associates it to the external VPC's MAIN ROUTE TABLE. If you want it associated to a different route table, you'll have to do so manually. ## Note: this associates it to the external VPC's MAIN ROUTE TABLE.
## If you want it associated to a different route table, you'll have to do so manually or set the table you want as the main route table.
resource "aws_route" "accepter_peering_route" { resource "aws_route" "accepter_peering_route" {
count = var.private_mode ? 1 : 0 count = var.private_mode && length(var.peered_vpc_ids) > 0 ? length(var.peered_vpc_ids) : 0
route_table_id = data.aws_vpc.peered_vpc[0].main_route_table_id route_table_id = data.aws_vpc.peered_vpc[count.index].main_route_table_id
destination_cidr_block = aws_vpc.vault.cidr_block destination_cidr_block = aws_vpc.vault.cidr_block
vpc_peering_connection_id = aws_vpc_peering_connection.vault[0].id vpc_peering_connection_id = aws_vpc_peering_connection.vault[count.index].id
} }