xdr-terraform-live/test/aws-us-gov/mdr-test-c2/099-vault-configuration/terragrunt.hcl

locals {
  # If you want to use any of the variables in _this_ file, you have to load them here.
  # However, they will all be available as inputs to the module loaded in terraform.source
  # below.
  environment_vars = read_terragrunt_config(find_in_parent_folders("env.hcl"))
  partition_vars   = read_terragrunt_config(find_in_parent_folders("partition.hcl"))
  region_vars      = read_terragrunt_config(find_in_parent_folders("region.hcl"))
  account_vars     = read_terragrunt_config(find_in_parent_folders("account.hcl"))
  global_vars      = read_terragrunt_config(find_in_parent_folders("globals.hcl"))
}

# Terragrunt will copy the Terraform configurations specified by the source parameter, along with any files in the
# working directory, into a temporary folder, and execute your Terraform commands in that folder.
terraform {
  # Double slash is intentional and required to show root of modules
  source = "git@github.xdr.accenturefederalcyber.com:mdr-engineering/xdr-terraform-modules.git//base/vault-configuration?ref=v4.2.11"
}

dependency "vpc-system-services" {
  config_path = "../010-vpc-system-services"
}

dependency "instance-vault" {
  config_path = "../090-instance-vault"
}

#Vault specific provider
generate "vault-provider" {
  path      = "vault-provider.tf"
  if_exists = "overwrite_terragrunt"
  contents  = <<EOF
#Provider block for Vault. 
provider "vault" {
  address = "https://${dependency.instance-vault.outputs.vault_alb_address}"
  skip_tls_verify = true
}
EOF
}

# Include all settings from the root terragrunt.hcl file
include {
  path = find_in_parent_folders()
}

# These are the variables we have to pass in to use the module specified in the terragrunt source above
inputs = {
  # All of the inputs from the inherited hcl files are available automatically
  # (via the `inputs` section of the root `terragrunt.hcl`). However, modules
  # will be more flexible if you specify particular input values.
  tags = {
    Purpose   = "Vault"
    Terraform = "aws/${basename(get_parent_terragrunt_dir())}/${path_relative_to_include()}/"
  }
  instance_name           = "vault"
  instance_type           = local.account_vars.locals.vault_server_instance_type
  vpc_id                  = dependency.vpc-system-services.outputs.vpc_id
  azs                     = dependency.vpc-system-services.outputs.azs
  subnets                 = dependency.vpc-system-services.outputs.private_subnets
  roles = {
    mdr-admins = {
      token_policies = ["admins"]
      bound_groups   = ["mdr-admins"]
    }
    mdr-engineers = {
      token_policies = ["engineers"]
      bound_groups   = ["mdr-engineers"]
    }
    phantom-role-administrator = {
      token_policies = ["phantom"]
      bound_groups   = ["phantom-role-administrator"]
    }
    vault-admins = {
      token_policies = ["admins"]
      bound_groups   = ["vault-admins"]
    }
    analyst-shift-lead = {
      token_policies = ["soc"]
      bound_groups   = ["analyst-shift-lead"]
    }
    analyst-tier-3 = {
      token_policies = ["soc"]
      bound_groups   = ["analyst-tier-3"]
    }
  }
}
terraform_version_constraint  = "= 1.1.6"
terragrunt_version_constraint = "= 0.36.2"