xdr-terraform-live/prod/aws-us-gov/mdr-prod-c2/090-instance-vault

Vault Setup Steps

• Run the 090-instance-vault module first
  • terragrunt apply
• Run these salt states on the Vault instances
  • salt vault*com saltutil.sync_all
  • salt vault*com saltutil.refresh_pillar
  • salt vault*com state.sls os_modifications test=true --state-output=changes
  • salt vault*com state.highstate test=true --state-output=changes
  • salt vault*com state.sls salt_minion.salt_minion_proxy test=true --state-output=changes
  • salt vault*com state.sls vault test=true --state-output=changes
  • salt vault*com state.sls vault pillar='{"kms_key_id": "<new-kms-key>"}' test=true --state-output=changes
• Ensure Vault is running and unseal the Vault via CLI on ONE of the Vault servers
  • export VAULT_ADDR=https://127.0.0.1
  • export VAULT_SKIP_VERIFY=1
  • vault status
  • vault operator init -recovery-shares=5 -recovery-threshold=2
  • Copy root token and 5 recovery shares to safe place
• On your Laptop, use the root Vault token to run the Terraform 099-vault-configuration module
  • vim ~/.vault-token
  • The DNS in the Terraform Vault provider will be used. To test connectivity be sure to run this command: export VAULT_ADDR=https://internal-vault-alb-test-778772793.us-gov-east-1.elb.amazonaws.com. Replace the ALB address with the current ALB DNS address. This is due to Golang DNS not updating when connected to XDR over VPN. Vault binary is written in Go.
    
  • Why not use the accenturefederal address? This is due to golang DNS issues.
  • Download the vault binary ( might not be needed? Is the binary in the TF provider? )
  • terragrunt apply
  • Might need this command as well. See main.tf in module for more information.
  • vault write auth/aws/config/client sts_endpoint=https://sts.us-gov-east-1.amazonaws.com sts_region=us-gov-east-1
  • The Terraform Vault provider will look at ~/.vault-token for the token and the bash variables for the address to connect to.
• Revoke the root token
  • vault token revoke <root-token>
• Distribute Vault shareds to the appriopriate individuals.
• Export/Import secrets
  • https://github.com/adamdecaf/vault-backend-migrator

For additional Vault documentation see these locations:

https://github.mdr.defpoint.com/mdr-engineering/infrastructure-notes/blob/master/Vault%20Notes.md

https://github.mdr.defpoint.com/mdr-engineering/msoc-infrastructure/blob/develop/salt/fileroots/vault/README.md

To apply without putting your junk in the terragrunt.hcl

THIS SECTION INCOMPLETE

1. VAULT_TOKEN: Login to vault, and click your name dropdown, then copy secret. You'll need it more than once.
2. TF_VAR_okta_api_token: Find this in the prod vault (even for test)
3. TF_VAR_okta_oidc_client_secret: Find this in the prod vault (even for test)

Then apply:

VAULT_TOKEN=<fromvault> TF_VAR_okta_api_token=YOURTOKENHERE TF_VAR_okta_oidc_client_secret=YOURSECRETHERE terragrunt apply