Domovská stránka Prehľadávať Pomoc
Registrovať Prihlásiť sa
AFS
/
xdr-terraform-modules
2
0
Fork 0
Súbory Issues 0 Pull requesty 0 Wiki
Strom: 213deec8f0
Branche Tagy
xdr-terraform-m...
/
base
/
customer_portal
Fred Damstra [afs macbook] c17eb3a25f Moves VPN to private subnets; Updates employee_ips / trusted_ips / admin_ips 3 rokov pred
..
cloud-init bd6e0a02e8 Disables Metadata for Splunk Servers; Adds Some Support for IMDSv2 3 rokov pred
README.md e532d854b5 Migrates Portal Lambda to Queue Based 3 rokov pred
amis.tf 19b6f1bfc5 Adds Portal to GC 4 rokov pred
certificate.tf 7a08ba10cf Migrated most variables out of xdr-terraform-live and into xdr-terraform-modules 3 rokov pred
constants.tf 7a08ba10cf Migrated most variables out of xdr-terraform-live and into xdr-terraform-modules 3 rokov pred
ecr.tf baa1f43824 Applied `terraform fmt` to all modules 3 rokov pred
elb.tf c17eb3a25f Moves VPN to private subnets; Updates employee_ips / trusted_ips / admin_ips 3 rokov pred
employee_ips.tf 7a08ba10cf Migrated most variables out of xdr-terraform-live and into xdr-terraform-modules 3 rokov pred
globals.tf 7a08ba10cf Migrated most variables out of xdr-terraform-live and into xdr-terraform-modules 3 rokov pred
main.tf 67c98b7677 Updates IMDS & ECR encryption syntax | tfsec/chekov ignores | 3 rokov pred
outputs.tf 55da096763 Adds init Customer Portal 5 rokov pred
rds.tf 67c98b7677 Updates IMDS & ECR encryption syntax | tfsec/chekov ignores | 3 rokov pred
vars.tf 7a08ba10cf Migrated most variables out of xdr-terraform-live and into xdr-terraform-modules 3 rokov pred
waf.tf 7a08ba10cf Migrated most variables out of xdr-terraform-live and into xdr-terraform-modules 3 rokov pred

README.md

xdr customer portal instances

Builds and configures the instances that host the customer portal website. NOTE: the grain ec2_tags:Name and the pillar aws_registry_account are required for portal salt state to complete successfully.

New Portal Server setup steps

  • test.version # are we on the correct salt version?
  • saltutil.sync_all
  • saltutil.refresh_modules # refresh grains
  • saltutil.refresh_pillar # refresh pillars
  • pillar.get aws_registry_account # This one is needed
  • slsutil.renderer salt://docker/portal.sls # Does this render properly?
  • grains.get environment # make sure "test" is present
  • state.sls os_modifications # get some base stuff out of the way
  • grains.get ec2_tags:Name # make sure customer-portal is present for highstate to work
  • state.highstate # push everything including docker and docker images

Vault Auth Issues

HELP! I destroyed then recreated the AWS IAM Portal Role and now Vault will not let me log in!!

In Vault disable the auth method vault auth disable aws

Then in terraform reapply the config. VAULT_TOKEN=<fromvault> TF_VAR_okta_api_token=YOURTOKENHERE TF_VAR_okta_oidc_client_secret=YOURSECRETHERE terragrunt-local apply -target=vault_auth_backend.aws -target=vault_aws_auth_backend_client.aws -target=vault_aws_auth_backend_role.portal

Vault apparently caches the AWS response for the portal IAM role.

https://blog.gruntwork.io/a-guide-to-automating-hashicorp-vault-3-authenticating-with-an-iam-user-or-role-a3203a3ee088 It is important to note that although the Vault Role is configured with the IAM principal ARN, what Vault actually checks against is a unique internal ID from AWS. So if you destroy and recreate your IAM Role, Vault will reject the login attempt.