This is originally forked from https://github.com/giuliocalzolari/terraform-aws-vault-dynamodb and changed to make it work with Terraform > 1.0

Hashicorp Vault is becoming one of the most popular tools for secret management, every company to improve their security but sometimes setting a Vault it requires some time and deep understanding on how to configure it. To make it easy the journey to AWS Cloud and increase the level of security of all application I've decided to create an out-of-the-box solution to configure the AWS infrastructure and setting up Vault in one click.

Created using CloudCraft

• AWS Autoscaling group with Userdata to install Vault and AWS Cloudwatch Agent.
• Vault with AWSKMS Auto-Unseal
• AWS DynamoDB as backend
• AWS Backup for DynamoDB
• basic Vault Provisioning
• Export of Vault sensitive parameters in AWS Paramaters Store
• Using AWS ARM instance with a1.medium as default to save cost

This module support Terraform >= 0.12.0 tested with 0.12, 0.13 and 0.14

Current module version

[
  "Default"
]

Fargate is a new AWS serverless technology for running Docker containers. It was considered for this project but rejected for several reasons:

1. No support for IPC_LOCK. Vault tries to lock its memory so that secret data is never swapped to disk. Although it seems unlikely Fargate swaps to disk, the lock capability is not provided.

2. Running on EC2 makes configuring Vault easier. The Ansible playbooks or bash included with this terraform build the Vault configuration for each server. It would be much harder to do this in a Fargate environment with sidecar containers or custom Vault images.

3. Running on EC2 makes DNS configuration easier. The Vault redirection method means you need to know the separate DNS endpoint names and doing this on Fargate is complicated. With EC2 we register some ElasticIPs and use those for the individual servers.

Many of these problems could be solved by running Vault in a custom image. However, it seemed valuable to use the Hashicorp Vault image instead of relying on custom built ones, so EC2 was chosen as the ECS technology.

please check the example folder.

Do you want to test your deployment? Just open your shell, adjust the DNS and kill the primary vault

for i in {1..500}
do
   RES=$(curl -s -o /dev/null -w "%{http_code}"  https://vault.[ YOUR DOMAIN ]/ui/)
   echo "[$(date +%T)] HTTP:$RES attemp:$i"
   sleep 1
done

in less than a minute the standby instance will be available and in few minutes the ASG will launch a new node

this repo is using pre-commit hook to know more click here to manually trigger use this command

pre-commit install
pre-commit run --all-files

• Autoscaling Group not encrypted EBS volume required to have a dedicated AMI already encrypted and required to have the proper service role for ASG to be albe to encrypt/decrypt the ebs volume

• ACM soft limit if you see this error Error requesting certificate: LimitExceededException: Error: you have reached your limit of 20 certificates in the last year. please increase the Limit using AWs Support of AWS Quota

• Cloudwatch Logs KMS Error Error: Creating CloudWatch Log Group failed: InvalidParameterException: The specified KMS Key Id could not be found., double check if the KMS key have proper policy to allow the regional Cloudwatch logs Service Principle (e.g. logs.eu-central-1.amazonaws.com)

• AWS Backup Vault can create an error (e.g. Error: error deleting Backup Vault (test-vault-dynamodb-backup): InvalidRequestException: Backup vault cannot be deleted (contains X recovery points)) if a backup is already created. Recovery point require to be mnually deleted

this repo is licensed under the WTFPL.