A Terraform Module for how to run Vault on AWS using Terraform and Packer
This repo contains a set of modules in the modules folder for deploying a Vault cluster on AWS using Terraform. Vault is an open source tool for managing secrets. By default, this Module uses Consul as a storage backend. You can optionally add an S3 backend for durability.
This Module includes:
private-tls-cert: Generate a private TLS certificate for use with a private Vault cluster.
update-certificate-store: Add a trusted, CA public key to an OS's certificate store. This allows you to establish TLS connections to services that use this TLS certs signed by this CA without getting x509 certificate errors.
This repo has the following structure:
modulesfolder to deploy Vault.
To deploy the Consul server cluster, use the Consul AWS Module.
To deploy the Vault cluster:
If you are just experimenting with this Module, you may find it more convenient to use one of our official public AMIs. Check out the
aws_amidata source usage in
main.tffor how to auto-discover this AMI.
WARNING! Do NOT use these AMIs in your production setup. In production, you should build your own AMIs in your own AWS account.
Deploy that AMI across an Auto Scaling Group in a private subnet using the Terraform vault-cluster module.
Execute the run-consul script with the
--clientflag during boot on each Instance to have the Consul agent connect to the Consul server cluster.
Execute the run-vault script during boot on each Instance to create the Vault cluster.
If you only need to access Vault from inside your AWS account (recommended), run the install-dnsmasq module on each server or setup-systemd-resolved (in the case of Ubuntu 18.04) and that server will be able to reach Vault using the Consul Server cluster as the DNS resolver (e.g. using an address like
vault.service.consul). See the vault-cluster-private example for working sample code.
If you need to access Vault from the public Internet, deploy the vault-elb module in a public subnet and have all requests to Vault go through the ELB. See the main.tf in the root folder of this repo example for working sample code.
Head over to the How do you use the Vault cluster? guide to learn how to initialize, unseal, and use Vault.
A Module is a canonical, reusable, best-practices definition for how to run a single piece of infrastructure, such as a database or server cluster. Each Module is created primarily using Terraform, includes automated tests, examples, and documentation, and is maintained both by the open source community and companies that provide commercial support.
Instead of having to figure out the details of how to run a piece of infrastructure from scratch, you can reuse existing code that has been proven in production. And instead of maintaining all that infrastructure code yourself, you can leverage the work of the Module community and maintainers, and pick up infrastructure improvements through a version number bump.
Contributions are very welcome! Check out the Contribution Guidelines for instructions.
During initial development, the major version will be 0 (e.g.,
0.x.y), which indicates the code does not yet have a stable API. Once we hit
1.0.0, we will make every effort to maintain a backwards compatible API and use the MAJOR, MINOR, and PATCH versions on each release to indicate any incompatibilities.
Copyright © 2020 Gruntwork, Inc.