AWS IAM Policy for Vault AWS Auth method #71

boldandbusted · 2018-06-01T21:59:30Z

Howdy. My second PR for this excellent module. I hope it is useful. Feedback and kind critique is welcome. :)

(I tried to 'git rebase HEAD~3' to squash my commits before the PR, and the commits are no longer listed on the branch in my repo... yet they mysteriously are listed below this PR. Sorry about the noise.)

Cheers!

…functionality, and enable by variable.

…_EC2_IAM_Auth variable.

…ault into Add_reccomended_Vault_IAM_Policy_for_AWS_Auth_method

…uster-private example.

…le module.

…switch over to s3-backend later.)

…switch over to s3-backend later.) Add variable reference.

…istry VPC module).

brikis98

Thanks for the PR!

A couple questions:

Is it worth updating the run-vault script with a flag to make it easy to enable the AWS auth backend?
Could you paste the output of running the automated tests? We can't run the CI build automatically for external PRs for security reasons.

brikis98 · 2018-06-03T00:28:14Z

examples/vault-cluster-private/main.tf

@@ -139,6 +140,10 @@ data "aws_vpc" "default" {

 data "aws_subnet_ids" "default" {
  vpc_id = "${data.aws_vpc.default.id}"
+
+  tags {
+    SubnetType = "private"


This should be configurable by variable and probably disabled by default. I know this is vault cluster private, but the default settings run it in the Default VPC, which for most users will have no private subnets. We could add comments to mention that for prod usage, this should be a custom VPC and private subnets.

brikis98 · 2018-06-03T03:56:37Z

modules/vault-cluster/main.tf

@@ -213,3 +214,27 @@ data "aws_iam_policy_document" "vault_s3" {
    ]
  }
 }
+
+resource "aws_iam_role_policy" "vault_aws_EC2_IAM_Auth" {


Please use all lower case for resource and variable names.

Done with latest commit, but I leave it to you to 'resolve', if you're satisfied. :)

brikis98 · 2018-06-03T03:57:16Z

modules/vault-cluster/main.tf

@@ -213,3 +214,27 @@ data "aws_iam_policy_document" "vault_s3" {
    ]
  }
 }
+
+resource "aws_iam_role_policy" "vault_aws_EC2_IAM_Auth" {
+  count  = "${var.enable_EC2_IAM_Auth ? 1 : 0}"


If enable_EC2_IAM_Auth is a boolean, the ? 1 : 0 bit is redundant, as a true is treated as a 1 and a false as a 0.

@brikis98 Done with latest commit, but I leave it to you to 'resolve', if you're satisfied. :) (TM)

brikis98 · 2018-06-03T03:57:42Z

modules/vault-cluster/main.tf

+      "ec2:DescribeInstances",
+      "iam:GetInstanceProfile",
+      "iam:GetUser",
+      "iam:GetRole",


Can you add a link to the docs where the requirements for these policies are defined?

I am setting up something similar myself. The docs for this policy are located at: https://www.vaultproject.io/docs/auth/aws.html#recommended-vault-iam-policy

However, it would be nice to have an option for the sts:AssumeRole action in a cross account scenario.

@brikis98 Done with latest commit but I leave it to you to 'resolve', if you're satisfied. :) @BMonsalvatge That's exactly where I got them. Thanks for the link. :) Re: cross-account 'sts:AssumeRole': I know the original policies have the sts:AssumeRole stanza, but I'm not sure how to properly enumerate the roles and accounts that's 'generic' for all cases. My present company doesn't really need it - we have sts:AssumeRole added to the IAM Instance Profile at line 175 in this file, and that was enough. However, I added a "TODO", seen in the recent commit. If you have this sussed out, I'd love to see it in the code, too. :)

brikis98 · 2018-06-03T03:58:36Z

modules/vault-cluster/variables.tf

@@ -185,3 +185,8 @@ variable "force_destroy_s3_bucket" {
  description = "If 'configure_s3_backend' is enabled and you set this to true, when you run terraform destroy, this tells Terraform to delete all the objects in the S3 bucket used for backend storage. You should NOT set this to true in production or you risk losing all your data! This property is only here so automated tests of this module can clean up after themselves. Only used if 'enable_s3_backend' is set to true."
  default     = false
 }
+
+variable "enable_EC2_IAM_Auth" {
+  description = "Configure IAM Instance Profile on Vault cluster members to permit the user to enable AWS Auth backend. Note that this does NOT actually enable the backend, but merely sets policies that will permit it to function as expected."


The description is a little confusing. Perhaps: "If set to true, create the IAM policies required by the AWS Auth backend. Note that this does NOT..."

brikis98 · 2018-06-03T03:58:48Z

modules/vault-cluster/variables.tf

@@ -185,3 +185,8 @@ variable "force_destroy_s3_bucket" {
  description = "If 'configure_s3_backend' is enabled and you set this to true, when you run terraform destroy, this tells Terraform to delete all the objects in the S3 bucket used for backend storage. You should NOT set this to true in production or you risk losing all your data! This property is only here so automated tests of this module can clean up after themselves. Only used if 'enable_s3_backend' is set to true."
  default     = false
 }
+
+variable "enable_EC2_IAM_Auth" {


Perhaps create_aws_auth_backend_iam_policies would be a clearer name?

boldandbusted · 2018-07-18T22:19:48Z

Hi @brikis98. Time got away from me... An update here. Finally got around to testing this, and see that I'm getting some terratest errors that I'll need to hunt down.

TestVaultClusterPublicWithUbuntuAmi 2018-07-18T18:12:01-04:00 command.go:98: Error: resource 'data.aws_vpc.default' config: unknown variable referenced: 'vpc_id'; define it with a 'variable' block

I'll dig into that. I'm thinking this might be because I had to add code to deal with my present company not having default VPCs defined. But not sure until I look.

brikis98 · 2018-07-19T09:55:50Z

Ah, yes, all the examples assume the default VPC to keep them simple. Turning on debug logging might make the underlying error easier to track down: https://www.terraform.io/docs/internals/debugging.html.

…ion.

brikis98 · 2018-10-01T14:52:08Z

@Etiene How does this overlap with the work you're doing?

…ault into IAM_Policy_for_Vault_AWS_Auth_method

…ggestion.

boldandbusted · 2018-10-01T15:48:14Z

I'm having trouble reliably running terratest - it's not the terratest code that is giving me grief, but GOPATH troubles. I was able to run it a few months ago, but now I cd to ./test, 'dep ensure', and I get:

$ dep ensure
root project import: /home/jesse/gits/terraform-aws-vault/test is not within any GOPATH/src

That said, I'm sure I still have to figure out how to properly handle the case of not having a default VPC in the test themselves.

boldandbusted · 2019-03-18T22:12:09Z

FYI, I just checked back on the status of this, and hadn't seen a notification regarding a CLA requirement. I hope that was not what was holding this up. :/ I just signed the CLA.

brikis98 · 2019-03-18T22:33:57Z

Oh, I think at the last comment, you were mentioning issues getting the tests to pass. Did you get that resolved? Also, there's now a merge conflict. Also, @Etiene had been working on something similar, so please check the latest to see what the overlap is.

boldandbusted · 2019-03-18T22:37:55Z

Oh, I think at the last comment, you were mentioning issues getting the tests to pass. Did you get that resolved? Also, there's now a merge conflict. Also, @Etiene had been working on something similar, so please check the latest to see what the overlap is.

@brikis98 Ah, sorry, I was wrong. I hadn't confirmed that this code works properly with a default VPC, and what happens with 'null' or empty string variables. But, I've signed the CLA, so that's out of the way.

hashicorp-cla · 2022-03-12T17:22:26Z

All committers have signed the CLA.

boldandbusted added 19 commits November 27, 2017 14:54

Add ability to specify VPC.

3323a71

Add non-default VPC support to vault-cluster-private example.

93339ed

Merge to preserve S3 persistent storage capability, hopefully.

6eee689

Create IAM Instance Profile Role policy to allow Vault AWS Auth full …

c624968

…functionality, and enable by variable.

Remove duplicate vpc_id variable; set default to false for new enable…

03d8194

…_EC2_IAM_Auth variable.

Expose more variables from underlying modules.

3eef292

Merge branch 'master' of https://github.com/hashicorp/terraform-aws-v…

720adbf

…ault into Add_reccomended_Vault_IAM_Policy_for_AWS_Auth_method

Move variables to proper modules, set enable_EC2_IAM_Auth on vault-cl…

6cf8e19

…uster-private example.

Expose s3, and EC2 IAM role components to vault-cluster-private examp…

7dc1638

…le module.

Copy user-data-vault.sh from vault-s3-backend. (Should probably just …

8de0eab

…switch over to s3-backend later.)

Copy user-data-vault.sh from vault-s3-backend. (Should probably just …

c544ca3

…switch over to s3-backend later.) Add variable reference.

Specific local changes to packer build.

8893851

Specify private subnets, using private_subnet_tags (see Terraform Reg…

b4f4e31

…istry VPC module).

Re-add consul-server configuring section. Oops.

ab63036

Filed hashicorp/vault#4383, staying at 0.9.X release of Vault for now.

fdeb3e0

Merge with upstream master.

17a02db

Merge with upstream origin.

a268913

Remove non-IAM-related work (S3 buckets and non-default VPCs.)

3b85902

Cleanup: run terraform fmt before PR. :)

932d711

brikis98 reviewed Jun 3, 2018

View reviewed changes

boldandbusted added 4 commits October 1, 2018 10:29

*_EC2_IAM_Auth -> *_ec2_iam_auth, yay sed.

7512e42

With suggestions by @brikis98, hopefully craft a clearer description.

199b04a

Rename -> create_aws_auth_backend_iam_policies, per @brikis98 suggest…

0f03108

…ion.

Add source for IAM policies.

69e47eb

boldandbusted added 2 commits October 1, 2018 10:57

Merge branch 'master' of https://github.com/hashicorp/terraform-aws-v…

dae9f4b

…ault into IAM_Policy_for_Vault_AWS_Auth_method

Remove redundant '? 1 : 0' for boolean variables, per @brikis98 PR su…

471b5f5

…ggestion.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

AWS IAM Policy for Vault AWS Auth method #71

AWS IAM Policy for Vault AWS Auth method #71

boldandbusted commented Jun 1, 2018

brikis98 left a comment

brikis98 Jun 3, 2018

brikis98 Jun 3, 2018

boldandbusted Oct 1, 2018

brikis98 Jun 3, 2018

boldandbusted Oct 1, 2018

brikis98 Jun 3, 2018

BMonsalvatge Jul 21, 2018

boldandbusted Oct 1, 2018

brikis98 Jun 3, 2018

brikis98 Jun 3, 2018

boldandbusted commented Jul 18, 2018

brikis98 commented Jul 19, 2018

brikis98 commented Oct 1, 2018

boldandbusted commented Oct 1, 2018

boldandbusted commented Mar 18, 2019 •

edited

Loading

brikis98 commented Mar 18, 2019

boldandbusted commented Mar 18, 2019

hashicorp-cla commented Mar 12, 2022 •

edited

Loading

AWS IAM Policy for Vault AWS Auth method #71

Are you sure you want to change the base?

AWS IAM Policy for Vault AWS Auth method #71

Conversation

boldandbusted commented Jun 1, 2018

brikis98 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

boldandbusted commented Jul 18, 2018

brikis98 commented Jul 19, 2018

brikis98 commented Oct 1, 2018

boldandbusted commented Oct 1, 2018

boldandbusted commented Mar 18, 2019 • edited Loading

brikis98 commented Mar 18, 2019

boldandbusted commented Mar 18, 2019

hashicorp-cla commented Mar 12, 2022 • edited Loading

boldandbusted commented Mar 18, 2019 •

edited

Loading

hashicorp-cla commented Mar 12, 2022 •

edited

Loading