Adds Vault

prod/aws-us-gov/mdr-prod-c2/090-instance-vault/README.md

@@ -0,0 +1,34 @@
+# Vault Setup Steps
+
+- Run the 090-instance-vault module first
+  - `terragrunt apply`
+- Run these salt states on the Vault instances
+  - `salt vault*com saltutil.sync_all`
+  - `salt vault*com saltutil.refresh_pillar`
+  - `salt vault*com state.sls os_modifications test=true --state-output=changes`
+  - `salt vault*com state.highstate test=true --state-output=changes`
+  - `salt vault*com state.sls vault test=true --state-output=changes`
+- Ensure Vault is running and unseal the Vault via CLI on ONE of the Vault servers
+  - `export VAULT_ADDR=https://127.0.0.1`
+  - `export VAULT_SKIP_VERIFY=1`
+  - `vault status`
+  - `vault operator init -recovery-shares=5 -recovery-threshold=2`
+  - Copy root token and 5 recovery shares to safe place
+- On your Laptop, use the root Vault token to run the Terraform 099-vault-configuration module
+  - `vim ~/.vault-token`
+  - The DNS in the Terraform Vault provider will be used. To test connectivity be sure to run this command: `export VAULT_ADDR=https://internal-vault-alb-test-778772793.us-gov-east-1.elb.amazonaws.com`. Replace the ALB address with the current ALB DNS address. This is due to Golang DNS not updating when connected to XDR over VPN. Vault binary is written in Go.  
+  - Why not use the accenturefederal address? This is due to golang DNS issues.
+  - Download the vault binary ( might not be needed? Is the binary in the TF provider? )
+  - `terragrunt apply`
+  - The Terraform Vault provider will look at ~/.vault-token for the token and the bash variables for the address to connect to.
+- Revoke the root token
+  - `vault token revoke <root-token>`
+- Distribute Vault shareds to the appriopriate individuals. 
+- Export/Import secrets
+  - https://github.com/adamdecaf/vault-backend-migrator 
+
+For additional Vault documentation see these locations:
+
+https://github.mdr.defpoint.com/mdr-engineering/infrastructure-notes/blob/master/Vault%20Notes.md
+
+https://github.mdr.defpoint.com/mdr-engineering/msoc-infrastructure/blob/develop/salt/fileroots/vault/README.md

prod/aws-us-gov/mdr-prod-c2/090-instance-vault/terragrunt.hcl

@@ -0,0 +1,42 @@
+locals {
+  # If you want to use any of the variables in _this_ file, you have to load them here.
+  # However, they will all be available as inputs to the module loaded in terraform.source
+  # below.
+  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
+  partition_vars = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
+  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
+  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
+  global_vars = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
+}
+
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  # Double slash is intentional and required to show root of modules
+  source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//base/vault?ref=v0.9.10"
+}
+
+dependency "vpc-system-services" {
+  config_path = "../010-vpc-system-services"
+}
+
+# Include all settings from the root terragrunt.hcl file
+include {
+  path = find_in_parent_folders()
+}
+
+# These are the variables we have to pass in to use the module specified in the terragrunt source above
+inputs = {
+  # All of the inputs from the inherited hcl files are available automatically
+  # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
+  # will be more flexible if you specify particular input values.
+  tags = {
+    Purpose = "Vault"
+    Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
+  }
+  instance_name = "vault"
+  instance_type = local.account_vars.locals.vault_server_instance_type
+  vpc_id = dependency.vpc-system-services.outputs.vpc_id
+  azs = dependency.vpc-system-services.outputs.azs
+  subnets = dependency.vpc-system-services.outputs.private_subnets
+}

prod/aws-us-gov/mdr-prod-c2/099-vault-configuration/README.md

@@ -0,0 +1 @@
+../090-instance-vault/README.md

prod/aws-us-gov/mdr-prod-c2/099-vault-configuration/terragrunt.hcl

@@ -0,0 +1,88 @@
+locals {
+  # If you want to use any of the variables in _this_ file, you have to load them here.
+  # However, they will all be available as inputs to the module loaded in terraform.source
+  # below.
+  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
+  partition_vars = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
+  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
+  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
+  global_vars = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
+}
+
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  # Double slash is intentional and required to show root of modules
+  source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//base/vault-configuration?ref=v0.9.10"
+}
+
+dependency "vpc-system-services" {
+  config_path = "../010-vpc-system-services"
+}
+
+dependency "instance-vault" {
+  config_path = "../090-instance-vault"
+}
+
+#Vault specific provider
+generate "vault-provider" {
+  path      = "vault-provider.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<EOF
+#Provider block for Vault. 
+provider "vault" {
+  version = "~> 2.15.0"
+  address = "https://${dependency.instance-vault.outputs.vault_alb_address}"
+}
+EOF
+}
+
+# Include all settings from the root terragrunt.hcl file
+include {
+  path = find_in_parent_folders()
+}
+
+# These are the variables we have to pass in to use the module specified in the terragrunt source above
+inputs = {
+  # All of the inputs from the inherited hcl files are available automatically
+  # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
+  # will be more flexible if you specify particular input values.
+  tags = {
+    Purpose = "Vault"
+    Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
+  }
+  instance_name = "vault"
+  instance_type = local.account_vars.locals.vault_server_instance_type
+  vpc_id = dependency.vpc-system-services.outputs.vpc_id
+  azs = dependency.vpc-system-services.outputs.azs
+  subnets = dependency.vpc-system-services.outputs.private_subnets
+  okta_oidc_client_id      = "0oa5jb5198xfxqLiE297"
+  okta_oidc_client_secret  = "<place secret here>"
+  okta_api_token           = "<place secret here>"
+  roles = {
+    mdr-admins = {
+      token_policies = ["admins"]
+      bound_groups = ["mdr-admins"]
+    }
+    mdr-engineers = {
+      token_policies = ["engineers"]
+      bound_groups = ["mdr-engineers"]
+    }
+    phantom-role-administrator = {
+      token_policies = ["phantom"]
+      bound_groups = ["phantom-role-administrator"]
+    }
+    vault-admins = {
+      token_policies = ["admins"]
+      bound_groups = ["vault-admins"]
+    }
+    analyst-shift-lead = {
+      token_policies = ["soc"]
+      bound_groups = ["analyst-shift-lead"]
+    }
+    analyst-tier-3 = {
+      token_policies = ["soc"]
+      bound_groups = ["analyst-tier-3"]
+    }
+  }
+}

prod/aws-us-gov/mdr-prod-c2/account.hcl

@@ -81,6 +81,9 @@ locals {
   # DNS Resolver
   resolver_instance_type = "t3a.micro"
 
+  # Vault Server
+  vault_server_instance_type = "t3a.micro"
+  
   # For testing
   create_test_instance = false
 

test/aws-us-gov/mdr-test-c2/090-instance-vault/README.md

@@ -0,0 +1 @@
+../../../../prod/aws-us-gov/mdr-prod-c2/090-instance-vault/README.md

test/aws-us-gov/mdr-test-c2/090-instance-vault/terragrunt.hcl

@@ -0,0 +1,42 @@
+locals {
+  # If you want to use any of the variables in _this_ file, you have to load them here.
+  # However, they will all be available as inputs to the module loaded in terraform.source
+  # below.
+  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
+  partition_vars = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
+  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
+  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
+  global_vars = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
+}
+
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  # Double slash is intentional and required to show root of modules
+  source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//base/vault?ref=v0.9.10"
+}
+
+dependency "vpc-system-services" {
+  config_path = "../010-vpc-system-services"
+}
+
+# Include all settings from the root terragrunt.hcl file
+include {
+  path = find_in_parent_folders()
+}
+
+# These are the variables we have to pass in to use the module specified in the terragrunt source above
+inputs = {
+  # All of the inputs from the inherited hcl files are available automatically
+  # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
+  # will be more flexible if you specify particular input values.
+  tags = {
+    Purpose = "Vault"
+    Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
+  }
+  instance_name = "vault"
+  instance_type = local.account_vars.locals.vault_server_instance_type
+  vpc_id = dependency.vpc-system-services.outputs.vpc_id
+  azs = dependency.vpc-system-services.outputs.azs
+  subnets = dependency.vpc-system-services.outputs.private_subnets
+}

test/aws-us-gov/mdr-test-c2/099-vault-configuration/README.md

@@ -0,0 +1 @@
+../../../../prod/aws-us-gov/mdr-prod-c2/090-instance-vault/README.md

test/aws-us-gov/mdr-test-c2/099-vault-configuration/terragrunt.hcl

@@ -0,0 +1,88 @@
+locals {
+  # If you want to use any of the variables in _this_ file, you have to load them here.
+  # However, they will all be available as inputs to the module loaded in terraform.source
+  # below.
+  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
+  partition_vars = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
+  region_vars = read_terragrunt_config(find_in_parent_folders("region.hcl"))
+  account_vars = read_terragrunt_config(find_in_parent_folders("account.hcl"))
+  global_vars = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
+}
+
+# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
+# working directory, into a temporary folder, and execute your Terraform commands in that folder.
+terraform {
+  # Double slash is intentional and required to show root of modules
+  source = "git@github.mdr.defpoint.com:mdr-engineering/xdr-terraform-modules.git//base/vault-configuration?ref=v0.9.10"
+}
+
+dependency "vpc-system-services" {
+  config_path = "../010-vpc-system-services"
+}
+
+dependency "instance-vault" {
+  config_path = "../090-instance-vault"
+}
+
+#Vault specific provider
+generate "vault-provider" {
+  path      = "vault-provider.tf"
+  if_exists = "overwrite_terragrunt"
+  contents  = <<EOF
+#Provider block for Vault. 
+provider "vault" {
+  version = "~> 2.15.0"
+  address = "https://${dependency.instance-vault.outputs.vault_alb_address}"
+}
+EOF
+}
+
+# Include all settings from the root terragrunt.hcl file
+include {
+  path = find_in_parent_folders()
+}
+
+# These are the variables we have to pass in to use the module specified in the terragrunt source above
+inputs = {
+  # All of the inputs from the inherited hcl files are available automatically
+  # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
+  # will be more flexible if you specify particular input values.
+  tags = {
+    Purpose = "Vault"
+    Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
+  }
+  instance_name = "vault"
+  instance_type = local.account_vars.locals.vault_server_instance_type
+  vpc_id = dependency.vpc-system-services.outputs.vpc_id
+  azs = dependency.vpc-system-services.outputs.azs
+  subnets = dependency.vpc-system-services.outputs.private_subnets
+  okta_oidc_client_id      = "0oa5icfdd1PdtoER0297"
+  okta_oidc_client_secret  = "<place secret here>"
+  okta_api_token           = "<place secret here>"
+  roles = {
+    mdr-admins = {
+      token_policies = ["admins"]
+      bound_groups = ["mdr-admins"]
+    }
+    mdr-engineers = {
+      token_policies = ["engineers"]
+      bound_groups = ["mdr-engineers"]
+    }
+    phantom-role-administrator = {
+      token_policies = ["phantom"]
+      bound_groups = ["phantom-role-administrator"]
+    }
+    vault-admins = {
+      token_policies = ["admins"]
+      bound_groups = ["vault-admins"]
+    }
+    analyst-shift-lead = {
+      token_policies = ["soc"]
+      bound_groups = ["analyst-shift-lead"]
+    }
+    analyst-tier-3 = {
+      token_policies = ["soc"]
+      bound_groups = ["analyst-tier-3"]
+    }
+  }
+}

test/aws-us-gov/mdr-test-c2/account.hcl

@@ -80,6 +80,9 @@ locals {
   # Repo Server
   repo_server_instance_type = "t3a.micro"
 
+  # Vault Server
+  vault_server_instance_type = "t3a.micro"
+
   # For testing
   create_test_instance = false
   test_instance_key_name = "fdamstra" # They with which to provision the test instance