This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| variable "approle_id" {} | |
| variable "approle_secret" {} | |
| provider "vault" { | |
| auth_login { | |
| namespace = "admin/terraform-vault-secrets-gcp" | |
| path = "auth/approle/login" | |
| parameters = { | |
| role_id = var.approle_id |
devops-adeel
/ vault_dr_acl.tf
Last active
April 21, 2022 10:13
Vault DR replication ACL following: https://learn.hashicorp.com/tutorials/vault/disaster-recovery?in=vault/day-one-raft#dr-operation-token-strategy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| locals { | |
| role_name = "failover-handler" | |
| } | |
| data "vault_policy_document" "default" { | |
| rule { | |
| path = "sys/replication/dr/secondary/promote" | |
| capabilities = ["update"] | |
| description = "Create and manage ACL policies" | |
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| locals { | |
| oidc_app = "hashicorp-vault-app" | |
| } | |
| data "auth0_tenant" "default" {} | |
| resource "auth0_connection" "default" { | |
| name = local.oidc_app | |
| strategy = "auth0" | |
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| resource "aws_iam_access_key" "default" { | |
| user = var.user | |
| } | |
| resource "vault_auth_backend" "default" { | |
| type = "aws" | |
| } | |
| resource "vault_aws_auth_backend_client" "default" { | |
| backend = vault_auth_backend.default.path |
devops-adeel
/ cicd_admin.tf
Last active
April 20, 2022 09:30
Lean Vault CICD Admin Policy to begin with.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| locals { | |
| member_entity_ids = var.entity_ids | |
| } | |
| data "vault_policy_document" "default" { | |
| rule { | |
| path = "sys/namespaces/" | |
| capabilities = ["list"] | |
| description = "List namespaces in root" | |
| } |
devops-adeel
/ aws_kms_auto_unseal.tf
Last active
April 20, 2022 18:00
Minimal AWS IAM permissions on S3 for raft auto-snapshot
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| data "aws_kms_key" "auto_unseal" { | |
| key_id = "alias/my-key" | |
| } | |
| data "aws_iam_policy_document" "auto_unseal" { | |
| version = "2012-10-17" | |
| statement { | |
| effect = "Allow" | |
| actions = [ | |
| "kms:DescribeKey", |
devops-adeel
/ github_actions_snippet.yaml
Last active
April 20, 2022 17:51
Github Actions OIDC Auth Method For Vault.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| jobs: | |
| build: | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Retrieve secret from Vault | |
| uses: hashicorp/vault-action@v2.4.0 | |
| with: | |
| url: https://vault-cluster-private-url.aws.hashicorp.cloud:8200 |
devops-adeel
/ aad_oidc_grp.tf
Last active
October 11, 2023 15:30
Terraform snippet to setup AzureAD Auth Method.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| locals { | |
| aad_group = var.aad_group | |
| application = var.application_name | |
| mount_accessor = var.mount_accessor | |
| } | |
| data "azuread_group" "default" { | |
| display_name = local.aad_group | |
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| locals { | |
| namespace = format( | |
| "{{identity.entity.aliases.%s.metadata.service_account_namespace}}", | |
| vault_auth_backend.default.accessor | |
| ) | |
| } | |
| data "kubernetes_service_account_v1" "default" { | |
| metadata { | |
| name = "vault-auth" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| resource "vault_ldap_auth_backend" "default" { | |
| path = "ldap" | |
| url = "ldaps://dc-01.example.org" | |
| userdn = "OU=Users,OU=Accounts,DC=example,DC=org" | |
| userattr = "sAMAccountName" | |
| upndomain = "EXAMPLE.ORG" | |
| discoverdn = false | |
| groupdn = "OU=Groups,DC=example,DC=org" | |
| groupfilter = "(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))" | |
| } |