Michael Li
333b9e855d
* chore(e2e): Use public version of enos * chore(e2e): Move vault module to this repo terraform-enos-aws-vault is no longer supported
57 lines
1.5 KiB
Terraform
57 lines
1.5 KiB
Terraform
# Copyright (c) HashiCorp, Inc.
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
locals {
|
|
consul_bin_path = "${var.consul_install_dir}/consul"
|
|
key_shares = {
|
|
"awskms" = null
|
|
"shamir" = 5
|
|
}
|
|
key_threshold = {
|
|
"awskms" = null
|
|
"shamir" = 3
|
|
}
|
|
followers = toset(slice(local.instances, 1, length(local.instances)))
|
|
instances = [for idx in range(var.instance_count) : tostring(idx)]
|
|
leader = toset(slice(local.instances, 0, 1))
|
|
name_suffix = "${var.project_name}-${var.environment}"
|
|
recovery_shares = {
|
|
"awskms" = 5
|
|
"shamir" = null
|
|
}
|
|
recovery_threshold = {
|
|
"awskms" = 3
|
|
"shamir" = null
|
|
}
|
|
seal = {
|
|
"awskms" = {
|
|
type = "awskms"
|
|
attributes = {
|
|
kms_key_id = var.kms_key_arn
|
|
}
|
|
}
|
|
"shamir" = {
|
|
type = "shamir"
|
|
attributes = null
|
|
}
|
|
}
|
|
storage_config = [for idx in local.vault_instances : (var.storage_backend == "raft" ?
|
|
merge(
|
|
{
|
|
node_id = "${var.vault_node_prefix}_${idx}"
|
|
},
|
|
var.storage_backend_addl_config
|
|
) :
|
|
{
|
|
address = "127.0.0.1:8500"
|
|
path = "vault"
|
|
})
|
|
]
|
|
vault_bin_path = "${var.vault_install_dir}/vault"
|
|
vault_cluster_tag = coalesce(var.vault_cluster_tag, "vault-server-${random_string.cluster_id.result}")
|
|
vault_instances = toset(local.instances)
|
|
audit_device_file_path = "/var/log/vault/vault_audit.log"
|
|
vault_service_user = "vault"
|
|
enable_audit_device = var.enable_file_audit_device && var.vault_init
|
|
}
|