/terraform-google-vault

Modular deployment of Vault on Google Compute Engine with Terraform

Primary LanguageHCLApache License 2.0Apache-2.0

Vault on GCE Terraform Module

Modular deployment of Vault on Compute Engine.

Unseal keys are generated when the instance first starts and stored encrypted using Cloud KMS in a separate Cloud Storage bucket for later retrival and Vault unsealing.

This module also creates a TLS CA and certificates for the Vault server. The generated certificates are encrypyed using Cloud KMS and stored in a separate Cloud Storage bucket.

Usage

module "vault" {
  source = "github.com/GoogleCloudPlatform/terraform-google-vault"
  project_id           = "${var.project_id}"
  region               = "${var.region}"
  zone                 = "${var.zone}"
  storage_bucket       = "${var.storage_bucket}"
  kms_keyring_name     = "${var.kms_keyring_name}"
}

Input variables

  • project_id (required): The project ID to add the IAM bindings for the service account to.
  • region (required): The region to create the instance in.
  • zone (required): The zone to create the instance in.
  • kms_keyring_name (required): The name of the Cloud KMS KeyRing for asset encryption.
  • kms_key_name: (optional): The name of the Cloud KMS Key used for asset encryption/decryption. Default is vault-init.
  • network (optional): The network to deploy to. Default is default.
  • subnetwork (optional): The subnetwork to deploy to. Default is default.
  • machine_type (optional): The machine type for the instance. Default is n1-standard-1
  • vault_args (optional): Additional command line arguments passed to vault server.
  • force_destroy_bucket (optional): Set to true to force deletion of backend bucket on terraform destroy. Default is false.
  • tls_ca_subject (optional): The subject block for the root CA certificate.
  • tls_dns_names (optional): List of DNS names added to the Vault server self-signed certificate. Default is ["vault.example.net"].
  • tls_ips (optional): List of IP addresses added to the Vault server self-signed certificate. Default is ["127.0.0.1"].
  • tls_cn (optional): The TLS Common Name for the TLS certificates. Default is vault.example.net.
  • tls_ou (optional): The TLS Organizational Unit for the TLS certificate. Default is IT Security Operations.

Output variables

  • instance_group: Link to the instance_group property of the instance group manager resource.
  • ca_private_key_algorithm: The root CA algorithm for generating client certs.
  • ca_private_key_pem: The root CA key pem for generating client certs.
  • ca_cert_pem: The root CA cert pem for generating client certs.

Resources created