A Terraform module for creating a HashiCorp Vault cluster

Contents

• Requirements
• Usage
  • Vault Amazon Machine Image
  • Terraform
  • Alerting
• Inputs
• Outputs
• License

Requirements

• Packer
• Terraform

Usage

This repository contains a Packer template and Terraform configurations for creating and provisioning a HashiCorp Vault cluster.

Note: Before running any Packer or Terraform commands, ensure that the following environment variables are assigned:

Name	Description
AWS_ACCESS_KEY_ID	Specifies an AWS access key associated with an IAM user or role
AWS_SECRET_ACCESS_KEY	Specifies the secret key associated with the access key
AWS_DEFAULT_REGION	Specifies the AWS Region to send the request to

See environment variables for more details.

What is HashiCorp Vault?

HashiCorp Vault is software for managing secrets and protecting sensitive data. To learn more about Vault, visit the official documentation.

What are the use cases of HashiCorp Vault?

Secrets Management

Vault centrally manages and enforces access to secrets and systems based on trusted sources of application and user identity.

Data Encryption

Vault provides encryption as a service with centralized key management to simplify encrypting data in transit and at rest across clouds and datacenters.

Vault Amazon Machine Image

This module assumes that an Amazon Machine Image (AMI) exists in the Amazon account used by the Terraform AWS Provider. The packer subdirectory contains a Packer template for building an AMI with the following software installed:

• HashiCorp Vault
• Amazon CloudWatch Agent (metrics and logging aggregation)

Before invoking any Terraform commands the AMI must exist in the AWS account used by Terraform.

For instructions on building the AMI using Packer, visit the README in the packer subdirectory.

Terraform

After building the AMI described in the Vault Amazon Machine Image section, invoke the following Terraform commands:

$ terraform init
$ terraform apply

For a complete list of available inputs, see the Inputs section.

Alerting

This module uses the notify-slack Terraform module to send messages to Slack workspaces when a CloudWatch Alarm is triggered. The alarms for this module are configured here and are changeable.

To enable alerting, create an incoming webhook in Slack. After creating the incoming wekbook, invoke terraform apply with the following variables:

Name	Description	Type
channel	Channel, private group, or IM channel to send message to	string
username	Set your bot's user name	string
webhook_url	The Incoming Webhook URL	string

$ terraform apply \
  -var 'channel=vault-alarms' \
  -var 'username=vault-bot' \
  -var 'webhook_url=https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX'

Inputs

Name	Description	Type	Default	Required
channel	Channel, private group, or IM channel to send message to	string	""	no
cidr_block	The IPv4 network range for the VPC, in CIDR notation	string	"10.0.0.0/16"	no
desired_capacity	The number of Amazon EC2 instances that the Auto Scaling group attempts to maintain	number	"null"	no
domain_name	Fully qualified domain name (FQDN), such as www.example.com, that you want to secure with an ACM certificate	string	"vault.corp.mongodb.com"	no
health_check_grace_period	The amount of time, in seconds, that Amazon EC2 Auto Scaling waits before checking the health status of an EC2 instance that has come into service	number	"300"	no
health_check_type	The service to use for the health checks	string	"EC2"	no
hosted_zone_id	The ID of the hosted zone that you want to create the record in	string	"ZYSJTA7XCIHDB"	no
hosted_zone_name	The name of the domain for the hosted zone where you want to add the resource record set	string	"vault.route53.build.10gen.cc"	no
ingress_ips	Allow traffic from the specified IPv4 or IPv6 CIDR addresses	list(string)	[ "0.0.0.0/0" ]	no
instance_type	Specifies the instance type of the EC2 instance	string	"m5.2xlarge"	no
key_name	Provides the name of the EC2 key pair	string	""	no
max_size	The maximum number of Amazon EC2 instances in the Auto Scaling group	number	n/a	yes
min_size	The minimum number of Amazon EC2 instances in the Auto Scaling group	number	n/a	yes
provisioned_throughput	Throughput for the specified table, which consists of values for ReadCapacityUnits and WriteCapacityUnits	map(number)	{ "read_capacity_units": 10, "write_capacity_units": 10 }	no
retention_in_days	The number of days to retain the log events in the specified log group	number	"7"	no
subnets	The IDs of the subnets for the load balancer	list(string)	[]	no
table_name	The name of the table to create	string	"vault-dynamodb-backend"	no
tags	Adds or overwrites the specified tags for the specified resources	map(string)	{}	no
username	Set your bot's user name	string	""	no
vpc_id	The ID of the VPC	string	""	no
vpc_zone_identifier	A list of subnet IDs for a virtual private cloud	list(string)	[]	no
webhook_url	The Incoming Webhook URL	string	""	no

Outputs

Name	Description
dashboard	URL to launch the CloudWatch dashboard for monitoring
dns_name	The DNS name of the load balancer

License

MIT License