diff options
Diffstat (limited to 'fdio.infra.terraform/terraform-vault-aws-secret-backend')
7 files changed, 114 insertions, 0 deletions
diff --git a/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/main.tf b/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/main.tf new file mode 100644 index 0000000000..4473dafda8 --- /dev/null +++ b/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/main.tf @@ -0,0 +1,17 @@ +module "fdio-logs" { + # fdio logs iam + source = "../" + name = "dynamic-aws-creds-vault-fdio-logs" +} + +module "fdio-docs" { + # fdio docs iam + source = "../" + name = "dynamic-aws-creds-vault-fdio-docs" +} + +module "fdio-csit-jenkins" { + # fdio csit jenkins iam + source = "../" + name = "dynamic-aws-creds-vault-fdio-csit-jenkins" +} diff --git a/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/providers.tf b/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/providers.tf new file mode 100644 index 0000000000..102fd31b87 --- /dev/null +++ b/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/providers.tf @@ -0,0 +1,5 @@ +provider "vault" { + address = var.vault_provider_address + skip_tls_verify = var.vault_provider_skip_tls_verify + token = var.vault_provider_token +}
\ No newline at end of file diff --git a/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/variables.tf b/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/variables.tf new file mode 100644 index 0000000000..e36ed08473 --- /dev/null +++ b/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/variables.tf @@ -0,0 +1,17 @@ +variable "vault_provider_address" { + description = "Vault cluster address." + type = string + default = "http://10.30.51.28:8200" +} + +variable "vault_provider_skip_tls_verify" { + description = "Verification of the Vault server's TLS certificate" + type = bool + default = false +} + +variable "vault_provider_token" { + description = "Vault root token" + type = string + sensitive = true +} diff --git a/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/versions.tf b/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/versions.tf new file mode 100644 index 0000000000..ec03c7c9ee --- /dev/null +++ b/fdio.infra.terraform/terraform-vault-aws-secret-backend/fdio/versions.tf @@ -0,0 +1,13 @@ +terraform { + backend "consul" { + address = "consul.service.consul:8500" + scheme = "http" + path = "fdio/terraform/1n/nomad" + } + required_providers { + vault = { + version = ">= 3.2.1" + } + } + required_version = ">= 1.1.4" +} diff --git a/fdio.infra.terraform/terraform-vault-aws-secret-backend/main.tf b/fdio.infra.terraform/terraform-vault-aws-secret-backend/main.tf new file mode 100644 index 0000000000..a65c390792 --- /dev/null +++ b/fdio.infra.terraform/terraform-vault-aws-secret-backend/main.tf @@ -0,0 +1,37 @@ +resource "vault_aws_secret_backend" "aws" { + access_key = var.aws_access_key + secret_key = var.aws_secret_key + path = "${var.name}-path" + + default_lease_ttl_seconds = "0" + max_lease_ttl_seconds = "0" +} + +resource "vault_aws_secret_backend_role" "admin" { + backend = vault_aws_secret_backend.aws.path + name = "${var.name}-role" + credential_type = "iam_user" + + policy_document = <<EOF +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "iam:*", "ec2:*" + ], + "Resource": "*" + } + ] +} +EOF +} + +output "backend" { + value = vault_aws_secret_backend.aws.path +} + +output "role" { + value = vault_aws_secret_backend_role.admin.name +} diff --git a/fdio.infra.terraform/terraform-vault-aws-secret-backend/variables.tf b/fdio.infra.terraform/terraform-vault-aws-secret-backend/variables.tf new file mode 100644 index 0000000000..2545345185 --- /dev/null +++ b/fdio.infra.terraform/terraform-vault-aws-secret-backend/variables.tf @@ -0,0 +1,17 @@ +variable "aws_access_key" { + description = "AWS access key" + type = string + sensitive = true +} + +variable "aws_secret_key" { + description = "AWS secret key" + type = string + sensitive = true +} + +variable "name" { + default = "dynamic-aws-creds-vault" + description = "Vault path" + type = string +} diff --git a/fdio.infra.terraform/terraform-vault-aws-secret-backend/versions.tf b/fdio.infra.terraform/terraform-vault-aws-secret-backend/versions.tf new file mode 100644 index 0000000000..996288568d --- /dev/null +++ b/fdio.infra.terraform/terraform-vault-aws-secret-backend/versions.tf @@ -0,0 +1,8 @@ +terraform { + required_providers { + vault = { + version = ">=2.22.1" + } + } + required_version = ">= 1.1.4" +} |