|
@@ -7,7 +7,9 @@
|
|
|
- `salt vault*com saltutil.refresh_pillar`
|
|
|
- `salt vault*com state.sls os_modifications test=true --state-output=changes`
|
|
|
- `salt vault*com state.highstate test=true --state-output=changes`
|
|
|
+ - `salt vault*com state.sls salt_minion.salt_minion_proxy test=true --state-output=changes`
|
|
|
- `salt vault*com state.sls vault test=true --state-output=changes`
|
|
|
+ - `salt vault*com state.sls vault pillar='{"kms_key_id": "<new-kms-key>"}' test=true --state-output=changes`
|
|
|
- Ensure Vault is running and unseal the Vault via CLI on ONE of the Vault servers
|
|
|
- `export VAULT_ADDR=https://127.0.0.1`
|
|
|
- `export VAULT_SKIP_VERIFY=1`
|
|
@@ -20,6 +22,8 @@
|
|
|
- Why not use the accenturefederal address? This is due to golang DNS issues.
|
|
|
- Download the vault binary ( might not be needed? Is the binary in the TF provider? )
|
|
|
- `terragrunt apply`
|
|
|
+ - Might need this command as well. See main.tf in module for more information.
|
|
|
+ - `vault write auth/aws/config/client sts_endpoint=https://sts.us-gov-east-1.amazonaws.com sts_region=us-gov-east-1`
|
|
|
- The Terraform Vault provider will look at ~/.vault-token for the token and the bash variables for the address to connect to.
|
|
|
- Revoke the root token
|
|
|
- `vault token revoke <root-token>`
|