This example deploys a fully working Vault instance into an ECS Cluster using KMS to auto unseal and PostgreSQL as the storage backend.
Only a single instance of Vault is deployed in this example.
As this is only an example your deployment strategy might differ, this is merely meant as a start-off point.
This project uses Rake as a build tool and nearly all necessary commands
are run through rake.
Please note that the order in which to run the commands are reflected by the
order of the blocks in Rakefile
- Domain
- AWS Account & Access Credentials
The following steps often require a deployment identifier and the domain you own.
We use tungsten (random element) and replace.me.uk in the instruction.
Other identifiers that need to be replaced
Identifiers that need to be replaced are indicated with {}.
deployment-identifier can be any random word; we like to use elements e.g. 'tungsten'.
domain has to be the base name of the domain you own e.g. 'example.com'
This deploys an S3 bucket in which all terraformstate files of the following steps are stored.
go "bootstrap:provision[{deployment-identifier}]"
Deploys a Route53 Domain.
go "domain:provision[{deployment-identifier},{domain}]"
This is a manual step where you have to update the nameservers on your domain to point to the public hosted zone created by the previous step.
go "certificate:provision[{deployment-identifier},{domain}]"
go "network:provision[{deployment-identifier}]"
ssh-keygen -t rsa -b 4096 -C bastion@{domain} -N '' -f config/secrets/bastion
Rename the generated files to ssh.private and ssh.public
go "bastion:provision[{deployment-identifier}]"
Currently infrablocks/bastion only allows outbound traffic on port 22. To be able to connect to the database add an outbound rule for port 5432.
The following command should give you access to the bastion. The public ip can be found in the info page of the EC2 instance in the AWS Console.
ssh -i config/secrets/bastion/ssh.private ec2-user@{bastion-public-ip}
go "database:provision[{deployment-identifier}]"
This may take a few minutes.
The following command will create a tunnel on your machine's port 5432 to the
database in RDS.
The host name can be found in the info page of the RDS instance in the AWS Console.
ssh -i config/secrets/bastion/ssh.private -N -L 5432:{rds-host-name}:5432 ec2-user@{bastion-public-ip}
There will be no output from this command and the terminal will keep the connection open until the command is terminated.
While the tunnel is open it should be possible to connect to the database
on localhost:5432.
go "database_migrations:provision[{deployment-identifier}]"
go "cluster:provision[{deployment-identifier}]"
go "service:provision[{deployment-identifier},{domain}]"
Access your Vault instance by accessing https://vault-{deployment-identifier}.{domain}
in your browser.