Skip to content

Commit 5e696b7

Browse files
leventyalcinleventyalcin
committed
credstash bundled in the module
1 parent ff097de commit 5e696b7

File tree

4 files changed

+266
-113
lines changed

4 files changed

+266
-113
lines changed

‎README.md

Lines changed: 9 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
1-
# Warning
2-
This module has not been tested yet. Start to use after it is tagged.
3-
41
# Overview
5-
This module setups a VPN server for a VPC to connect to instances
2+
This module setups a VPN server for a VPC to connect to instances.
63

74
*Before you start to use the module you have to make sure you've created resources below*
85

@@ -14,6 +11,8 @@ After provisioning, don't forget to run commands below:
1411
* `export BACKUP_ENCRYPTION_KEY=$(uuidgen)`
1512
* `credstash -r REGION -t CREDSTASH_TABLE_NAME put -k alias/CREDSTASH_TABLE_NAME BACKUP_ENCRYPTION_KEY $BACKUP_ENCRYPTION_KEY`
1613
* `credstash -r REGION -t CREDSTASH_TABLE_NAME put -k alias/CREDSTASH_TABLE_NAME HEALTHCHECKS_IO_KEY CHANGEME-WITH-THE-KEY-FROM-HEALTHCHECKS-IO`
14+
* **Pritunl setup**
15+
* `sudo pritunl setup-key`
1716

1817
# Input variables
1918

@@ -37,27 +36,18 @@ After provisioning, don't forget to run commands below:
3736
# Usage
3837

3938
```
40-
provider "aws" {
41-
region = "eu-west-1"
42-
}
4339
44-
data "aws_caller_identity" "current" { }
45-
46-
module "credstash" {
47-
source = "github.com/opsgang/terraform_credstash?ref=1.0.0"
48-
49-
product = "vpn"
50-
env = "dev"
51-
aws_account_id = "${data.aws_caller_identity.current.account_id}"
40+
provider "aws" {
41+
region="eu-west-1"
5242
}
5343
5444
module "app_pritunl" {
5545
source = "github.com/opsgang/terraform_pritunl?ref=1.0.0"
5646
57-
aws_key_name = "vpn-ssh-key"
58-
vpc_id = "vpc-99999999"
59-
public_subnet_id = "subnet-99999999"
60-
ami_id = "ami-99999999"
47+
aws_key_name = "org-eu-west-1"
48+
vpc_id = "${module.vpc.vpc_id}"
49+
public_subnet_id = "${module.vpc.public_subnets[1]}"
50+
ami_id = "ami-01ccc867"
6151
instance_type = "t2.small"
6252
office_ip_cidrs = [
6353
"8.8.8.8/32"

‎main.tf

Lines changed: 91 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,105 @@ data "aws_region" "current" {
22
current = true
33
}
44

5+
data "aws_caller_identity" "current" {}
6+
57
data "template_file" "user_data" {
68
template = "${file("${path.module}/templates/user_data.sh.tpl")}"
79

810
vars {
9-
aws_region = "${aws_region.current.name}"
11+
aws_region = "${data.aws_region.current.name}"
1012
s3_backup_bucket = "${var.tag_product}-${var.tag_env}-backup"
1113
credstash_table_name = "credstash-${var.tag_product}-${var.tag_env}"
1214
}
1315
}
1416

17+
data "template_file" "credstash_policy" {
18+
template = "${file("${path.module}/templates/key_policy.json.tpl")}"
19+
20+
vars {
21+
tag_product = "${var.tag_product}"
22+
tag_env = "${var.tag_env}"
23+
key_admin_arn = "${aws_iam_role.role.arn}"
24+
account_id = "${data.aws_caller_identity.current.account_id}"
25+
}
26+
}
27+
28+
data "template_file" "iam_instance_role_policy" {
29+
template = "${file("${path.module}/templates/iam_instance_role_policy.json.tpl")}"
30+
31+
vars {
32+
tag_product = "${var.tag_product}"
33+
tag_env = "${var.tag_product}"
34+
db_credstash_arn = "${aws_dynamodb_table.db_credstash.arn}"
35+
}
36+
}
37+
38+
resource "aws_dynamodb_table" "db_credstash" {
39+
name = "credstash-${var.tag_product}-${var.tag_env}"
40+
read_capacity = 1
41+
write_capacity = 1
42+
hash_key = "name"
43+
range_key = "version"
44+
45+
attribute {
46+
name = "name"
47+
type = "S"
48+
}
49+
50+
attribute {
51+
name = "version"
52+
type = "S"
53+
}
54+
55+
tags {
56+
Name = "credstash-${var.tag_product}-${var.tag_env}"
57+
product = "${var.tag_product}"
58+
env = "${var.tag_env}"
59+
purpose = "${var.tag_purpose}"
60+
role = "${var.tag_role}"
61+
}
62+
}
63+
64+
resource "null_resource" "waiter" {
65+
66+
depends_on = ["aws_iam_instance_profile.ec2_profile"]
67+
68+
provisioner "local-exec" {
69+
command = "sleep 15"
70+
}
71+
}
72+
73+
resource "aws_kms_key" "credstash" {
74+
75+
depends_on = ["null_resource.waiter"]
76+
77+
description = "Credstash space for ${var.tag_product}-${var.tag_env}"
78+
#policy = "${data.template_file.credstash_policy.rendered}"
79+
policy = "${data.template_file.credstash_policy.rendered}"
80+
deletion_window_in_days = 7
81+
is_enabled = true
82+
enable_key_rotation = true
83+
84+
tags {
85+
Name = "credstash-${var.tag_product}-${var.tag_env}"
86+
product = "${var.tag_product}"
87+
env = "${var.tag_env}"
88+
purpose = "${var.tag_purpose}"
89+
role = "${var.tag_role}"
90+
}
91+
}
92+
93+
resource "aws_kms_alias" "credstash" {
94+
95+
depends_on = ["aws_kms_key.credstash"]
96+
97+
name = "alias/credstash-${var.tag_product}-${var.tag_env}"
98+
target_key_id = "${aws_kms_key.credstash.key_id}"
99+
}
100+
15101
resource "aws_s3_bucket" "backup" {
16102
bucket = "${var.tag_product}-${var.tag_env}-backup"
17-
acl = "private"
103+
acl = "private"
18104

19105
lifecycle_rule {
20106
prefix = "backups"
@@ -62,104 +148,15 @@ resource "aws_iam_role_policy" "policy" {
62148

63149
name = "${var.tag_product}-${var.tag_env}"
64150
role = "${aws_iam_role.role.id}"
65-
policy = <<EOF
66-
{
67-
"Version": "2012-10-17",
68-
"Statement": [
69-
{
70-
"Effect": "Allow",
71-
"Action": [
72-
"kms:*",
73-
"dynamodb:*"
74-
],
75-
"Resource": "*"
76-
},
77-
{
78-
"Effect": "Allow",
79-
"Action": [
80-
"s3:ListBucket",
81-
"s3:GetBucketLocation"
82-
],
83-
"Resource": [ "arn:aws:s3:::${var.tag_product}-${var.tag_env}-backup" ]
84-
},
85-
{
86-
"Effect": "Allow",
87-
"Action": [
88-
"s3:AbortMultipartUpload",
89-
"s3:PutObject*",
90-
"s3:Get*",
91-
"s3:List*",
92-
"s3:DeleteObject"
93-
],
94-
"Resource": [ "arn:aws:s3:::${var.tag_product}-${var.tag_env}-backup/*" ]
95-
},
96-
{
97-
"Effect": "Allow",
98-
"Action": [
99-
"ssm:DescribeAssociation",
100-
"ssm:GetDocument",
101-
"ssm:ListAssociations",
102-
"ssm:UpdateAssociationStatus",
103-
"ssm:UpdateInstanceInformation"
104-
],
105-
"Resource": "*"
106-
},
107-
{
108-
"Effect": "Allow",
109-
"Action": [
110-
"ec2messages:AcknowledgeMessage",
111-
"ec2messages:DeleteMessage",
112-
"ec2messages:FailMessage",
113-
"ec2messages:GetEndpoint",
114-
"ec2messages:GetMessages",
115-
"ec2messages:SendReply"
116-
],
117-
"Resource": "*"
118-
},
119-
{
120-
"Effect": "Allow",
121-
"Action": [
122-
"cloudwatch:PutMetricData"
123-
],
124-
"Resource": "*"
125-
},
126-
{
127-
"Effect": "Allow",
128-
"Action": [
129-
"ec2:DescribeInstanceStatus"
130-
],
131-
"Resource": "*"
132-
},
133-
{
134-
"Effect": "Allow",
135-
"Action": [
136-
"ds:CreateComputer",
137-
"ds:DescribeDirectories"
138-
],
139-
"Resource": "*"
140-
},
141-
{
142-
"Effect": "Allow",
143-
"Action": [
144-
"logs:CreateLogGroup",
145-
"logs:CreateLogStream",
146-
"logs:DescribeLogGroups",
147-
"logs:DescribeLogStreams",
148-
"logs:PutLogEvents"
149-
],
150-
"Resource": "*"
151-
}
152-
]
153-
}
154-
EOF
151+
policy = "${data.template_file.iam_instance_role_policy.rendered}"
155152
}
156153

157154
resource "aws_iam_instance_profile" "ec2_profile" {
158155

159156
depends_on = ["aws_iam_role.role", "aws_iam_role_policy.policy"]
160157

161-
name = "${var.tag_product}-${var.tag_env}"
162-
roles = ["${aws_iam_role.role.name}"]
158+
name = "${var.tag_product}-${var.tag_env}"
159+
role = "${aws_iam_role.role.name}"
163160
}
164161

165162
resource "aws_security_group" "pritunl" {

‎templates/iam_instance_role_policy.json.tpl

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Action": [
6+
"dynamodb:PutItem",
7+
"dynamodb:GetItem",
8+
"dynamodb:Query",
9+
"dynamodb:Scan"
10+
],
11+
"Effect": "Allow",
12+
"Resource": "${db_credstash_arn}"
13+
},
14+
{
15+
"Effect": "Allow",
16+
"Action": [
17+
"s3:ListBucket",
18+
"s3:GetBucketLocation"
19+
],
20+
"Resource": [ "arn:aws:s3:::${tag_product}-${tag_env}-backup" ]
21+
},
22+
{
23+
"Effect": "Allow",
24+
"Action": [
25+
"s3:AbortMultipartUpload",
26+
"s3:PutObject*",
27+
"s3:Get*",
28+
"s3:List*",
29+
"s3:DeleteObject"
30+
],
31+
"Resource": [ "arn:aws:s3:::${tag_product}-${tag_env}-backup/*" ]
32+
},
33+
{
34+
"Effect": "Allow",
35+
"Action": [
36+
"ssm:DescribeAssociation",
37+
"ssm:GetDocument",
38+
"ssm:ListAssociations",
39+
"ssm:UpdateAssociationStatus",
40+
"ssm:UpdateInstanceInformation"
41+
],
42+
"Resource": "*"
43+
},
44+
{
45+
"Effect": "Allow",
46+
"Action": [
47+
"ec2messages:AcknowledgeMessage",
48+
"ec2messages:DeleteMessage",
49+
"ec2messages:FailMessage",
50+
"ec2messages:GetEndpoint",
51+
"ec2messages:GetMessages",
52+
"ec2messages:SendReply"
53+
],
54+
"Resource": "*"
55+
},
56+
{
57+
"Effect": "Allow",
58+
"Action": [
59+
"cloudwatch:PutMetricData"
60+
],
61+
"Resource": "*"
62+
},
63+
{
64+
"Effect": "Allow",
65+
"Action": [
66+
"ec2:DescribeInstanceStatus"
67+
],
68+
"Resource": "*"
69+
},
70+
{
71+
"Effect": "Allow",
72+
"Action": [
73+
"ds:CreateComputer",
74+
"ds:DescribeDirectories"
75+
],
76+
"Resource": "*"
77+
},
78+
{
79+
"Effect": "Allow",
80+
"Action": [
81+
"logs:CreateLogGroup",
82+
"logs:CreateLogStream",
83+
"logs:DescribeLogGroups",
84+
"logs:DescribeLogStreams",
85+
"logs:PutLogEvents"
86+
],
87+
"Resource": "*"
88+
}
89+
]
90+
}

0 commit comments

Comments
 (0)